From 6ad3901bc8fc927101901ddb0a389c62b5d904b5 Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Thu, 1 Oct 2026 16:43:48 +0200 Subject: [PATCH 01/14] Updating Set of Nirsoft Detections --- .../detection_of_tools_built_by_nirsoft.yml | 11 +++-- .../possible_browser_pass_view_parameter.yml | 11 +++-- .../windows_nirsoft_advancedrun.yml | 9 +++- ...ndows_nirsoft_tool_bundle_file_created.yml | 36 +++++++-------- .../endpoint/windows_nirsoft_utilities.yml | 46 +++++++++++++++---- 5 files changed, 79 insertions(+), 34 deletions(-) rename detections/{endpoint => deprecated}/detection_of_tools_built_by_nirsoft.yml (93%) rename detections/{endpoint => deprecated}/possible_browser_pass_view_parameter.yml (93%) rename detections/{endpoint => deprecated}/windows_nirsoft_advancedrun.yml (96%) diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml similarity index 93% rename from detections/endpoint/detection_of_tools_built_by_nirsoft.yml rename to detections/deprecated/detection_of_tools_built_by_nirsoft.yml index c41a4a0605d..b9fe2c8e5e9 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Bhavin Patel, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system. data_source: @@ -53,3 +53,8 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: Detection deprecated due to duplicated content. + removed_in_version: 6.8.0 + replacement_content: + - Windows NirSoft Utilities \ No newline at end of file diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml similarity index 93% rename from detections/endpoint/possible_browser_pass_view_parameter.yml rename to detections/deprecated/possible_browser_pass_view_parameter.yml index 70b5aa3b1a2..0430f8fdbfe 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -1,10 +1,10 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 8 +version: 9 creation_date: '2021-11-22' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches. data_source: @@ -35,3 +35,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content. + removed_in_version: 6.8.0 + replacement_content: + - Windows NirSoft Utilities \ No newline at end of file diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml similarity index 96% rename from detections/endpoint/windows_nirsoft_advancedrun.yml rename to detections/deprecated/windows_nirsoft_advancedrun.yml index b91a5c4c4c5..4f798311ecd 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -1,10 +1,10 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 12 +version: 13 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment. data_source: @@ -85,3 +85,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content. + removed_in_version: 6.8.0 + replacement_content: + - Windows NirSoft Utilities \ No newline at end of file diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 3d410e82b46..ad9dac81e2e 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -1,9 +1,9 @@ name: Windows NirSoft Tool Bundle File Created id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41 -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-01' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | @@ -20,23 +20,18 @@ search: | min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem where + FROM datamodel=Endpoint.Filesystem + WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` + [ + | inputlookup nirsoft_utilities_lookup.csv + | search original_file_name=*.zip + | table original_file_name + | rename original_file_name as Filesystem.file_name + ] - Filesystem.file_name IN ( - "brtools.zip", - "mailpv.zip", - "networktools.zip", - "passreccommandline.zip", - "passrecenc.zip", - "progtools.zip", - "rdpv.zip", - "systools.zip", - "webbrowserpassview.zip" - ) - - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product @@ -71,7 +66,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool bundle file $file_name$ created on host $dest$ + message: NirSoft tool bundle file [$file_name$] created on host [$dest$]. +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path analytic_story: - Unusual Processes - Data Destruction diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index eb146d19cc4..d7bc71604fe 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -5,43 +5,73 @@ creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: Hunting +type: Anomaly description: | The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + as lastTime + + FROM datamodel=Endpoint.Processes + WHERE + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + + | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile - | search nirsoftFile=true | `windows_nirsoft_utilities_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + To successfully implement this search, you need to be ingesting process creation events from your endpoints using Sysmon. + These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: NirSoft tool [$process_name$] was executed on host [$dest$]. This utility [$description$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - Data Destruction - WhisperGate + - Unusual Processes asset_type: Endpoint atomic_guid: - 81ce22fd-9612-4154-918e-8a1f285d214d From 668f2386a36c2ded2b91ef17d918af2fbff364d7 Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Thu, 1 Oct 2026 16:45:50 +0200 Subject: [PATCH 02/14] adding lookups --- lookups/csv/nirsoft_utilities_lookup.csv | 580 +++++++++++++++++++++++ lookups/csv/nirsoft_utilities_lookup.yml | 12 + 2 files changed, 592 insertions(+) create mode 100644 lookups/csv/nirsoft_utilities_lookup.csv create mode 100644 lookups/csv/nirsoft_utilities_lookup.yml diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv new file mode 100644 index 00000000000..196992f6def --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -0,0 +1,580 @@ +original_file_name,description +AddrView.exe,"Extract URL addresses from HTML pages." +AdvancedRun.exe,"Run a program with different settings that you choose." +AllThreadsView.exe,"Displays a list of all running threads in Windows" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." +AppAudioConfig.exe,"View/change audio settings of applications" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." +BluetoothCL.exe,"Show bluetooth devices list" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " +BulkFileChanger.exe,"Change date/time/attributes of multiple files." +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." +CProcess.exe,"Displays the list of all processes currently running on your system." +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " +CleanAfterMe.exe,"Clean files and Registry values in your system." +Clipboardic.exe,"Small and simple clipboard manager." +ControlMyMonitor.exe,"View and modify the settings of your monitor." +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." +CredHistView.exe,"Decrypt the CREDHIST file of Windows" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." +DevManView.exe,"Alternative to the standard Device Manager of Windows." +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." +DiskCountersView.exe,"Show disk drive read/write counters." +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." +DownTester.exe,"Test your Internet download speed." +DriveLetterView.exe,"View and change drive letter assignments " +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." +DumpEDID.exe,"Dump EDID information into the console window." +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" +ExtPassword.exe,"External Drive Password Recovery" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " +FileAccessErrorView.exe,"Displays file access error information" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." +FileTypesMan.exe,"Alternative to the File Types manager of Windows." +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." +FlashCookiesView.exe,"View Flash cookies stored in your computer." +FolderChangesView.exe,"Monitor folder/drive changes." +FolderTimeUpdate.exe,"Updates the Modified Time of folders." +FreeSpaceLogView.exe,"View log of free disk space on Windows" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " +GDIView.exe,"Displays the list of GDI handles opened by every process" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." +HandleCountersView.exe,"Shows handle counter for every process" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." +HtmlAsText.exe,"Converts HTML documents to simple text files." +HtmlDocEdit.exe,"Simple HTML designer/editor" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " +IPInfoOffline.exe,"view country information about IP addresses." +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" +IPPathTableView.exe,"IP Path Table Viewer" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." +InjectedDLL.exe,"Display the list of injected DLLs." +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." +InstalledAppView.exe,"View installed Windows 10 apps" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." +InstalledPackagesView.exe,"Displays installed MSI packages on your system." +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." +LANIPScanner.exe,"Local network scanner for Windows" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " +LastActivityView.exe,"View the latest computer activity." +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." +LoadedDllsView.exe,"Displays all DLL files loaded on your system." +LostMyPassword.exe,"Password recovery tool for Windows" +MACAddressView.exe,"MAC address lookup tool" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." +MUICacheView.exe,"Edit/delete MUICache items in your system" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" +MonitorInfoView.exe,"displays essential information about your monitor." +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." +NetResView.exe,"displays the list of all network resources on your LAN." +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." +OfflineRegistryFinder.exe,"Find data in external Registry files" +OfflineRegistryView.exe,"View offline Registry files" +OpenSaveFilesView.exe,"Displays list of files that you previously opened." +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OperaCacheView.exe,"Cache viewer for Opera Web browser." +OperaPassView.exe,"Password recovery tool for Opera Web browser." +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." +OutlookStatView.exe,"Display a general statistics of your Outlook emails." +PasswordFox.exe,"View passwords stored in Firefox Web browser." +PasswordScan.exe,"Displays security information about passwords stored in your system." +PingInfoView.exe,"ping multiple host names and IP addresses." +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" +ProcessActivityView.exe,"Show the file activity for selected process." +ProcessTCPSummary.exe,"Displays TCP connections summary" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" +PropertySystemView.exe,"View/edit file properties" +PstPassword.exe,"Recover lost password of Outlook PST file." +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." +RecentFilesView.exe,"Display the list of recently opened files" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." +RegFileExport.exe,"Export offline Registry file to .reg file" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." +RouterPassView.exe,"Recover passwords from router config file." +RunAsDate.exe,"Run a program with the specified date." +RunFromProcess.exe,"Run a program from another process that you choose." +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" +SafariHistoryView.exe,"History viewer for Safari Web browser" +SearchFilterView.exe,"view the search filters installed on your system." +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." +SecurityQuestionsView.exe,"View Windows 10 security questions" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." +ShadowCopyView.exe,"View shadow copies on your system" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" +SiteShoter.exe,"Save a screenshot of any Web page into a file." +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." +SkypeLogView.exe,"View log files created by Skype" +SniffPass.exe,"capture the passwords that pass through your network adapter." +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" +SpecialFoldersView.exe,"Easily jump to special folders in your system." +TCPConnectProblemView.exe,"Monitor TCP connection problems." +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." +TcpLogView.exe,"Monitors the opened TCP connections on your system." +TimeZonesView.exe,"Displays all world time zones." +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" +USBDeview.exe,"Lists all installed USB devices that you previously used." +USBDriveLog.exe,"USB Drive Log For Windows 10" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" +UserProfilesView.exe,"View user profiles information on your system." +VNCPassView.exe,"Recover the passwords stored by the VNC tool." +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" +WNetWatcher.exe,"Shows who is connected to your wireless network." +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." +WebCamImageSave.exe,"Capture still images from your WebCam." +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." +WhatIsHang.exe,"Get information about Windows software that hangs." +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." +WinCrashReport.exe,"Displays a report about crashed Windows application." +WinDefLogView.exe,"Windows Defender Log Viewer" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" +WinFontsView.exe,"Display sample of all fonts installed on your system." +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." +WinUpdatesView.exe,"Displays the history of Windows updates for your system." +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." +WirelessNetConsole.exe,"View wireless networks information (console application)" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." +acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." +awatch.exe,"displays useful information about your network adapters." +axhelper.exe,"view essential information about ActiveX components installed on your computer." +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." +folrep.exe,"Scans your disk, and displays a report about each folder." +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" +jrview.exe,"Displays the installed Java Runtime Environments." +jsae.exe,"Creates Javascript animation from image files on your local drive." +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." +mailpv.exe,"Recovers email passwords" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." +nircmd.exe,"Do many useful tasks from command-line." +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." +serviwin.exe,"displays the list of installed drivers and services on your system." +shexview.exe,"Displays the details of shell extensions installed on your computer." +shman.exe,"Lists all shortcuts on your desktop/start menu." +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." +strun.exe,"Displays the list of all applications that are loaded on startup." +svcl.exe,"Sound volume command-line tool for Windows" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." +whosip.exe,"find all available information about an IP address from command-line." +winlister.exe,"This utility displays the list of opened windows on your system. " +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." +zipinst.exe,"Install applications that do not provide an installation module." +acm.zip,"ZIP Bundle for acm.exe" +addrview.zip,"ZIP Bundle for AddrView.exe" +advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.zip,"ZIP Bundle for axhelper.exe" +batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" +brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +chromepass.zip#dl.zip_,"ZIP Bundle for ChromePass.exe" +cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.zip,"ZIP Bundle for cports.exe" +cprocess.zip,"ZIP Bundle for CProcess.exe" +credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +credhistview.zip,"ZIP Bundle for CredHistView.exe" +csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.zip,"ZIP Bundle for ctie.exe" +customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +devmanview.zip,"ZIP Bundle for DevManView.exe" +dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +dialupass.zip#dl.zip_,"ZIP Bundle for Dialupass.exe" +diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.zip,"ZIP Bundle for dllexp.exe" +dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" +domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +downtester.zip,"ZIP Bundle for DownTester.exe" +driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +driverview.zip,"ZIP Bundle for DriverView.exe" +dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +extpassword.zip,"ZIP Bundle for ExtPassword.exe" +fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.zip,"ZIP Bundle for faview.exe" +fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.zip,"ZIP Bundle for folrep.exe" +freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.zip,"ZIP Bundle for gacview.exe" +gdiview.zip,"ZIP Bundle for GDIView.exe" +getnir.zip,"ZIP Bundle for GetNir.exe" +guipropview.zip,"ZIP Bundle for GUIPropView.exe" +handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.zip,"ZIP Bundle for iconsext.exe" +iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.zip,"ZIP Bundle for iecv.exe" +iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.zip,"ZIP Bundle for iehv.exe" +iepv.zip#dl.zip_,"ZIP Bundle for iepv.exe" +imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.zip,"ZIP Bundle for jrview.exe" +jsae.zip,"ZIP Bundle for jsae.exe" +jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.zip,"ZIP Bundle for mailpv.exe" +managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mdnsview.zip,"ZIP Bundle for mDNSView.exe" +mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.zip,"ZIP Bundle for mmview.exe" +mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.zip,"ZIP Bundle for mspass.exe" +muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.zip,"ZIP Bundle for mweather.exe" +myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.zip,"ZIP Bundle for myuninst.exe" +mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.zip,"ZIP Bundle for mzcv.exe" +netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.zip#dl.zip_,"ZIP Bundle for netpass.exe" +netresview.zip,"ZIP Bundle for NetResView.exe" +netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" +networktools.zip,"ZIP Bundle for cports.exe" +networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.zip,"ZIP Bundle for nirext.exe" +nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.zip,"ZIP Bundle for nk2view.exe" +ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +officeins.zip,"ZIP Bundle for OfficeIns.exe" +offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" +ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +openwithview.zip,"ZIP Bundle for OpenWithView.exe" +operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +operapassview.zip,"ZIP Bundle for OperaPassView.exe" +outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" +outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passrecpk.zip,"ZIP Bundle for mspass.exe" +passwordfox.zip#dl.zip_,"ZIP Bundle for PasswordFox.exe" +passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +produkey.zip,"ZIP Bundle for ProduKey.exe" +progtools.zip,"ZIP Bundle for dllexp.exe" +propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.zip,"ZIP Bundle for pspv.exe" +pstpassword.zip,"ZIP Bundle for PstPassword.exe" +quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.zip,"ZIP Bundle for rdpv.exe" +recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +regdllview.zip,"ZIP Bundle for RegDllView.exe" +regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +regscanner.zip,"ZIP Bundle for RegScanner.exe" +regtools.zip,"ZIP Bundle for RegScanner.exe" +resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +runasdate.zip,"ZIP Bundle for RunAsDate.exe" +runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.zip,"ZIP Bundle for serviwin.exe" +shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.zip,"ZIP Bundle for shexview.exe" +shman.zip,"ZIP Bundle for shman.exe" +shmnview.zip,"ZIP Bundle for shmnview.exe" +shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.zip,"ZIP Bundle for smsniff.exe" +sniffpass.zip,"ZIP Bundle for SniffPass.exe" +socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.zip,"ZIP Bundle for strun.exe" +svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.zip,"ZIP Bundle for sysexp.exe" +systools.zip,"ZIP Bundle for ProduKey.exe" +tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +uninstallview.zip,"ZIP Bundle for UninstallView.exe" +urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +usbdeview.zip,"ZIP Bundle for USBDeview.exe" +usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +usblogview.zip,"ZIP Bundle for USBLogView.exe" +userassistview.zip,"ZIP Bundle for UserAssistView.exe" +userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" +videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.zip,"ZIP Bundle for volumouse.exe" +wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +webbrowserpassview.zip#dl.zip_,"ZIP Bundle for WebBrowserPassView.exe" +webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.zip,"ZIP Bundle for whosip.exe" +wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.zip,"ZIP Bundle for winlister.exe" +winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +wirelesskeyview.zip#dl.zip_,"ZIP Bundle for WirelessKeyView.exe" +wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.zip,"ZIP Bundle for wul.exe" +zipinst.zip,"ZIP Bundle for zipinst.exe" \ No newline at end of file diff --git a/lookups/csv/nirsoft_utilities_lookup.yml b/lookups/csv/nirsoft_utilities_lookup.yml new file mode 100644 index 00000000000..ebd1525ea4c --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.yml @@ -0,0 +1,12 @@ +name: nirsoft_utilities_lookup +id: 9ebf4dba-02a9-4f64-9f06-f02d4023c52a +version: 1 +creation_date: '2026-10-01' +modification_date: '2026-10-01' +author: Splunk Threat Research Team +lookup_type: csv +description: A subset of utilities provided by NirSoft that may be used by adversaries. +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +case_sensitive_match: false From 01752d3be9ee776e740b575d72c7b1d46c24275b Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Thu, 1 Oct 2026 17:03:30 +0200 Subject: [PATCH 03/14] fixing yaml issues --- detections/deprecated/detection_of_tools_built_by_nirsoft.yml | 2 +- detections/deprecated/possible_browser_pass_view_parameter.yml | 2 +- detections/deprecated/windows_nirsoft_advancedrun.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml index b9fe2c8e5e9..0f9871b3b60 100644 --- a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -57,4 +57,4 @@ deprecation_info: reason: Detection deprecated due to duplicated content. removed_in_version: 6.8.0 replacement_content: - - Windows NirSoft Utilities \ No newline at end of file + - Windows NirSoft Utilities diff --git a/detections/deprecated/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml index 0430f8fdbfe..d80503798a2 100644 --- a/detections/deprecated/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -39,4 +39,4 @@ deprecation_info: reason: Detection deprecated due to duplicated content. removed_in_version: 6.8.0 replacement_content: - - Windows NirSoft Utilities \ No newline at end of file + - Windows NirSoft Utilities diff --git a/detections/deprecated/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml index 4f798311ecd..e0e0e280ad0 100644 --- a/detections/deprecated/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -89,4 +89,4 @@ deprecation_info: reason: Detection deprecated due to duplicated content. removed_in_version: 6.8.0 replacement_content: - - Windows NirSoft Utilities \ No newline at end of file + - Windows NirSoft Utilities From aa1b58d2b5056c524fdb9296a3ef9f13497cd0f3 Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Fri, 2 Oct 2026 15:36:39 +0200 Subject: [PATCH 04/14] update deprecation info --- detections/deprecated/detection_of_tools_built_by_nirsoft.yml | 2 +- detections/deprecated/possible_browser_pass_view_parameter.yml | 2 +- detections/deprecated/windows_nirsoft_advancedrun.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml index 0f9871b3b60..91ff310e0b1 100644 --- a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -55,6 +55,6 @@ category: endpoint security_domain: endpoint deprecation_info: reason: Detection deprecated due to duplicated content. - removed_in_version: 6.8.0 + removed_in_version: 6.10.0 replacement_content: - Windows NirSoft Utilities diff --git a/detections/deprecated/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml index d80503798a2..6192d198849 100644 --- a/detections/deprecated/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -37,6 +37,6 @@ tests: test_type: unit deprecation_info: reason: Detection deprecated due to duplicated content. - removed_in_version: 6.8.0 + removed_in_version: 6.10.0 replacement_content: - Windows NirSoft Utilities diff --git a/detections/deprecated/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml index e0e0e280ad0..87e2f6aafcb 100644 --- a/detections/deprecated/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -87,6 +87,6 @@ tests: test_type: unit deprecation_info: reason: Detection deprecated due to duplicated content. - removed_in_version: 6.8.0 + removed_in_version: 6.10.0 replacement_content: - Windows NirSoft Utilities From af6bc54b7ba745eb0a0cd3f531266df6376d617b Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 2 Oct 2026 19:06:21 +0200 Subject: [PATCH 05/14] Update windows_nirsoft_tool_bundle_file_created.yml --- .../endpoint/windows_nirsoft_tool_bundle_file_created.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index ad9dac81e2e..f0390a6df82 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -25,7 +25,7 @@ search: | ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` [ - | inputlookup nirsoft_utilities_lookup.csv + | inputlookup nirsoft_utilities_lookup | search original_file_name=*.zip | table original_file_name | rename original_file_name as Filesystem.file_name From 75d8eac1549a274964a13d6def72fc90bb4c7d19 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 19:29:57 +0200 Subject: [PATCH 06/14] small updates to form --- detections/deprecated/detection_of_tools_built_by_nirsoft.yml | 4 ++-- .../deprecated/possible_browser_pass_view_parameter.yml | 4 ++-- detections/deprecated/windows_nirsoft_advancedrun.yml | 4 ++-- .../endpoint/windows_nirsoft_tool_bundle_file_created.yml | 3 +-- detections/endpoint/windows_nirsoft_utilities.yml | 2 +- 5 files changed, 8 insertions(+), 9 deletions(-) diff --git a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml index 91ff310e0b1..2fe7690cc05 100644 --- a/detections/deprecated/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -54,7 +54,7 @@ product: category: endpoint security_domain: endpoint deprecation_info: - reason: Detection deprecated due to duplicated content. - removed_in_version: 6.10.0 + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 replacement_content: - Windows NirSoft Utilities diff --git a/detections/deprecated/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml index 6192d198849..b21bcb9a319 100644 --- a/detections/deprecated/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -36,7 +36,7 @@ tests: sourcetype: XmlWinEventLog test_type: unit deprecation_info: - reason: Detection deprecated due to duplicated content. - removed_in_version: 6.10.0 + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 replacement_content: - Windows NirSoft Utilities diff --git a/detections/deprecated/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml index 87e2f6aafcb..8e8fc5ffdff 100644 --- a/detections/deprecated/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -86,7 +86,7 @@ tests: sourcetype: XmlWinEventLog test_type: unit deprecation_info: - reason: Detection deprecated due to duplicated content. - removed_in_version: 6.10.0 + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 replacement_content: - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index f0390a6df82..39f57e0612d 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -7,8 +7,7 @@ author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects the creation of files associated with the NirSoft - tool bundles on Windows endpoints. + The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools. diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index d7bc71604fe..73814378efd 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -64,7 +64,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool [$process_name$] was executed on host [$dest$]. This utility [$description$]. + message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$]. threat_objects: - field: process_name type: process_name From 7479657406b432ec4063fbfba593731119e74ed1 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 20:43:20 +0200 Subject: [PATCH 07/14] small updates --- .../endpoint/windows_nirsoft_tool_bundle_file_created.yml | 2 +- lookups/csv/nirsoft_utilities_lookup.csv | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 39f57e0612d..d2b4fe68d3a 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -25,7 +25,7 @@ search: | ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` [ | inputlookup nirsoft_utilities_lookup - | search original_file_name=*.zip + | search original_file_name IN (*.zip, *.zip#dl.zip) | table original_file_name | rename original_file_name as Filesystem.file_name ] diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv index 196992f6def..924cc8cc8db 100644 --- a/lookups/csv/nirsoft_utilities_lookup.csv +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -463,7 +463,9 @@ outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" passrecpk.zip,"ZIP Bundle for mspass.exe" +passrecview.zip,"ZIP Bundle for PassRecView.exe" passwordfox.zip#dl.zip_,"ZIP Bundle for PasswordFox.exe" passwordscan.zip,"ZIP Bundle for PasswordScan.exe" pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" From b8d251213a571fdf570be1e1195f46bfa447b726 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 00:30:21 +0200 Subject: [PATCH 08/14] Update detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml --- .../endpoint/windows_nirsoft_tool_bundle_file_created.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index d2b4fe68d3a..4d8eef7aa27 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -87,7 +87,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit From ab6db4672bcef686d11929bcc41c329fa586c871 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:30:59 +0200 Subject: [PATCH 09/14] Update windows_nirsoft_utilities.yml --- detections/endpoint/windows_nirsoft_utilities.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 73814378efd..0ca85dbc36e 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,6 +1,6 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk From 231c453837c02f26cbbba108dbefab06d56f2dda Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 19:48:35 +0200 Subject: [PATCH 10/14] small updates --- ...ndows_nirsoft_tool_bundle_file_created.yml | 2 +- .../endpoint/windows_nirsoft_utilities.yml | 26 ++++++++++--------- lookups/csv/nirsoft_utilities_lookup.csv | 17 ++++++------ 3 files changed, 24 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 4d8eef7aa27..d980ca8b3be 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -25,7 +25,7 @@ search: | ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` [ | inputlookup nirsoft_utilities_lookup - | search original_file_name IN (*.zip, *.zip#dl.zip) + | search original_file_name = "*.zip" | table original_file_name | rename original_file_name as Filesystem.file_name ] diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 0ca85dbc36e..4d1b02cbab0 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -16,17 +16,18 @@ data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime - FROM datamodel=Endpoint.Processes - WHERE - [ - | inputlookup nirsoft_utilities_lookup - | search original_file_name=*.exe - | table original_file_name - | rename original_file_name as Processes.original_file_name - ] + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id @@ -34,6 +35,7 @@ search: | Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description @@ -42,8 +44,8 @@ search: | | `security_content_ctime(lastTime)` | `windows_nirsoft_utilities_filter` how_to_implement: |- - To successfully implement this search, you need to be ingesting process creation events from your endpoints using Sysmon. - These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). + To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). + Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model. known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv index 924cc8cc8db..df960cbc48f 100644 --- a/lookups/csv/nirsoft_utilities_lookup.csv +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -319,7 +319,7 @@ bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" -chromepass.zip#dl.zip_,"ZIP Bundle for ChromePass.exe" +chromepass.zip,"ZIP Bundle for ChromePass.exe" cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" clipboardic.zip,"ZIP Bundle for Clipboardic.exe" controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" @@ -335,7 +335,7 @@ dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" devmanview.zip,"ZIP Bundle for DevManView.exe" dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" -dialupass.zip#dl.zip_,"ZIP Bundle for Dialupass.exe" +dialupass.zip,"ZIP Bundle for Dialupass.exe" diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" dllexp.zip,"ZIP Bundle for dllexp.exe" @@ -389,7 +389,7 @@ iecacheview.zip,"ZIP Bundle for IECacheView.exe" iecv.zip,"ZIP Bundle for iecv.exe" iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" iehv.zip,"ZIP Bundle for iehv.exe" -iepv.zip#dl.zip_,"ZIP Bundle for iepv.exe" +iepv.zip,"ZIP Bundle for iepv.exe" imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" @@ -434,7 +434,7 @@ mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" mzcv.zip,"ZIP Bundle for mzcv.exe" netbscanner.zip,"ZIP Bundle for NetBScanner.exe" netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" -netpass.zip#dl.zip_,"ZIP Bundle for netpass.exe" +netpass.zip,"ZIP Bundle for netpass.exe" netresview.zip,"ZIP Bundle for NetResView.exe" netrouteview.zip,"ZIP Bundle for NetRouteView.exe" networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" @@ -464,9 +464,10 @@ outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" outlooktools.zip,"ZIP Bundle for nk2edit.exe" passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" +passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" passrecpk.zip,"ZIP Bundle for mspass.exe" passrecview.zip,"ZIP Bundle for PassRecView.exe" -passwordfox.zip#dl.zip_,"ZIP Bundle for PasswordFox.exe" +passwordfox.zip,"ZIP Bundle for PasswordFox.exe" passwordscan.zip,"ZIP Bundle for PasswordScan.exe" pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" @@ -546,7 +547,7 @@ vncpassview.zip,"ZIP Bundle for VNCPassView.exe" volumouse.zip,"ZIP Bundle for volumouse.exe" wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" -webbrowserpassview.zip#dl.zip_,"ZIP Bundle for WebBrowserPassView.exe" +webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" @@ -574,9 +575,9 @@ winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" -wirelesskeyview.zip#dl.zip_,"ZIP Bundle for WirelessKeyView.exe" +wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" wul.zip,"ZIP Bundle for wul.exe" -zipinst.zip,"ZIP Bundle for zipinst.exe" \ No newline at end of file +zipinst.zip,"ZIP Bundle for zipinst.exe" From ae644b8fe4dfaf8ce2fefe4f243d315eb435b114 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 20:10:27 +0200 Subject: [PATCH 11/14] Update nirsoft_utilities_lookup.csv --- lookups/csv/nirsoft_utilities_lookup.csv | 577 ++++++++++++----------- 1 file changed, 290 insertions(+), 287 deletions(-) diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv index df960cbc48f..d38974e2953 100644 --- a/lookups/csv/nirsoft_utilities_lookup.csv +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -1,583 +1,586 @@ original_file_name,description -AddrView.exe,"Extract URL addresses from HTML pages." -AdvancedRun.exe,"Run a program with different settings that you choose." -AllThreadsView.exe,"Displays a list of all running threads in Windows" -AltStreamDump.exe,"Dumps the list of NTFS alternate streams" -AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." -AppAudioConfig.exe,"View/change audio settings of applications" -AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" -AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " -AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" -AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." -AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " -BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." -BatteryInfoView.exe,"Displays battery information on laptops and netbooks." -BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." -BluetoothCL.exe,"Show bluetooth devices list" -BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." -BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." -BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." -BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" -BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." -BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" -BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" -BrowsingHistoryView.exe,"View browsing history of popular Web browsers " -BulkFileChanger.exe,"Change date/time/attributes of multiple files." -BulletsPassView.exe,"Reveals the passwords stored behind the bullets." -CProcess.exe,"Displays the list of all processes currently running on your system." -CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" -ChromeCacheView.exe,"Chrome Browser Cache Viewer" -ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" -ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" -ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " -CleanAfterMe.exe,"Clean files and Registry values in your system." -Clipboardic.exe,"Small and simple clipboard manager." -ControlMyMonitor.exe,"View and modify the settings of your monitor." -CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." -CredHistView.exe,"Decrypt the CREDHIST file of Windows" -CredentialsFileView.exe,"Decrypts Credentials files of Windows." -CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." -DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." -DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " -DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" -DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " -DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." -DevManView.exe,"Alternative to the standard Device Manager of Windows." -DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." -DiskCountersView.exe,"Show disk drive read/write counters." -DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." -DomainHostingView.exe,"Displays extensive information about a domain." -DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" -DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." -DownTester.exe,"Test your Internet download speed." -DriveLetterView.exe,"View and change drive letter assignments " -DriverView.exe,"Displays the list of all device drivers currently loaded on your system." -DumpEDID.exe,"Dump EDID information into the console window." -ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" -EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" -EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." -EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." -EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " -ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." -ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" -ExtPassword.exe,"External Drive Password Recovery" -FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." -FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " -FileAccessErrorView.exe,"Displays file access error information" -FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." -FileTypesMan.exe,"Alternative to the File Types manager of Windows." -FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" -FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." -FlashCookiesView.exe,"View Flash cookies stored in your computer." -FolderChangesView.exe,"Monitor folder/drive changes." -FolderTimeUpdate.exe,"Updates the Modified Time of folders." -FreeSpaceLogView.exe,"View log of free disk space on Windows" -FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." -FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " -GDIView.exe,"Displays the list of GDI handles opened by every process" -GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" -GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" -HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." -HandleCountersView.exe,"Shows handle counter for every process" -HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" -HeapMemView.exe,"View the content of all memory blocks allocated in the heap." -HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" -HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." -HtmlAsText.exe,"Converts HTML documents to simple text files." -HtmlDocEdit.exe,"Simple HTML designer/editor" -IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." -IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " -IPInfoOffline.exe,"view country information about IP addresses." -IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" -IPPathTableView.exe,"IP Path Table Viewer" -ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." -InjectedDLL.exe,"Display the list of injected DLLs." -InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." -InstalledAppView.exe,"View installed Windows 10 apps" -InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." -InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." -InstalledPackagesView.exe,"Displays installed MSI packages on your system." -JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." -KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." -LANIPScanner.exe,"Local network scanner for Windows" -LSASecretsDump.exe,"Dump the LSA secrets from the Registry." -LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " -LastActivityView.exe,"View the latest computer activity." -LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." -LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." -LoadedDllsView.exe,"Displays all DLL files loaded on your system." -LostMyPassword.exe,"Password recovery tool for Windows" -MACAddressView.exe,"MAC address lookup tool" -MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." -MUICacheView.exe,"Edit/delete MUICache items in your system" -MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." -MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" -ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " -MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" -MonitorInfoView.exe,"displays essential information about your monitor." -MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." -MozillaHistoryView.exe,"Package of Web browser tools for Windows" -MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." -MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." -MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" -NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" -NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." -NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" -NetConnectChoose.exe,"Set default Internet connection and view general connection information." -NetResView.exe,"displays the list of all network resources on your LAN." -NetRouteView.exe,"GUI alternative to the standard route utility of Windows." -NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." -NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." -NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." -NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." -NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." -NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" -NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" -OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." -OfflineRegistryFinder.exe,"Find data in external Registry files" -OfflineRegistryView.exe,"View offline Registry files" -OpenSaveFilesView.exe,"Displays list of files that you previously opened." -OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." -OpenedFilesView.exe,"Displays the list of all opened files on your system." -OperaCacheView.exe,"Cache viewer for Opera Web browser." -OperaPassView.exe,"Password recovery tool for Opera Web browser." -OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" -OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" -OutlookAttachView.exe,"Extract multiple attachments from Outlook." -OutlookStatView.exe,"Display a general statistics of your Outlook emails." -PasswordFox.exe,"View passwords stored in Firefox Web browser." -PasswordScan.exe,"Displays security information about passwords stored in your system." -PingInfoView.exe,"ping multiple host names and IP addresses." -PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" -PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" -ProcessActivityView.exe,"Show the file activity for selected process." -ProcessTCPSummary.exe,"Displays TCP connections summary" -ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." -ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." -ProduKey.exe,"Package of system tools for Windows" -ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" -PropertySystemView.exe,"View/edit file properties" -PstPassword.exe,"Recover lost password of Outlook PST file." -QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." -RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." -RecentFilesView.exe,"Display the list of recently opened files" -RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." -RegFileExport.exe,"Export offline Registry file to .reg file" -RegFromApp.exe,"Creates .reg file according to Registry changes made by application." -RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" -RegScanner.exe,"Scan and find values in the Registry" -RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." -ResourcesExtract.exe,"Extract embedded resources from .NET applications." -ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." -RouterPassView.exe,"Recover passwords from router config file." -RunAsDate.exe,"Run a program with the specified date." -RunFromProcess.exe,"Run a program from another process that you choose." -RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" -SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" -SafariHistoryView.exe,"History viewer for Safari Web browser" -SearchFilterView.exe,"view the search filters installed on your system." -SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." -SecurityQuestionsView.exe,"View Windows 10 security questions" -SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." -SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." -ShadowCopyView.exe,"View shadow copies on your system" -ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " -ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." -ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" -SimpleCodeGenerator.exe,"QR Code Generator for Windows" -SimpleProgramDebugger.exe,"Displays debugging events of a running program." -SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" -SiteShoter.exe,"Save a screenshot of any Web page into a file." -SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." -SkypeLogView.exe,"View log files created by Skype" -SniffPass.exe,"capture the passwords that pass through your network adapter." -SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." -SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." -SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" -SpecialFoldersView.exe,"Easily jump to special folders in your system." -TCPConnectProblemView.exe,"Monitor TCP connection problems." -TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." -TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." -TcpLogView.exe,"Monitors the opened TCP connections on your system." -TimeZonesView.exe,"Displays all world time zones." -TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." -URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" -URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" -USBDeview.exe,"Lists all installed USB devices that you previously used." -USBDriveLog.exe,"USB Drive Log For Windows 10" -USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" -UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." -UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" -UserProfilesView.exe,"View user profiles information on your system." -VNCPassView.exe,"Recover the passwords stored by the VNC tool." -VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" -VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" -WNetWatcher.exe,"Shows who is connected to your wireless network." -WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" -WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." -WebBrowserPassView.exe,"Recover lost passwords from your Web browser." -WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." -WebCamImageSave.exe,"Capture still images from your WebCam." -WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" -WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." -WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." -WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." -WhatIsHang.exe,"Get information about Windows software that hangs." -WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." -WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." -WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." -WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" -WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " -WifiInfoView.exe,"Displays extensive information about wireless networks in your area." -WinCrashReport.exe,"Displays a report about crashed Windows application." -WinDefLogView.exe,"Windows Defender Log Viewer" -WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" -WinFontsView.exe,"Display sample of all fonts installed on your system." -WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" -WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" -WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." -WinUpdatesView.exe,"Displays the history of Windows updates for your system." -WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." -WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." -WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" -WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." -WirelessNetConsole.exe,"View wireless networks information (console application)" -WirelessNetView.exe,"Monitor the activity of wireless networks around you." acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." -awatch.exe,"displays useful information about your network adapters." -axhelper.exe,"view essential information about ActiveX components installed on your computer." -cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." -cports.exe,"Package of network monitoring tools for Windows" -ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." -dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." -dllexp.exe,"Small utilities package that can be used by programmers for debugging." -faview.exe,"displays the list of all your Favorties/bookmarks in a single page." -folrep.exe,"Scans your disk, and displays a report about each folder." -gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." -iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" -iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" -iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." -iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" -jrview.exe,"Displays the installed Java Runtime Environments." -jsae.exe,"Creates Javascript animation from image files on your local drive." -mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." -mailpv.exe,"Recovers email passwords" -mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." -mspass.exe,"Password Recovery package for Windows." -mspass.exe,"Recovers the passwords of instant messenger programs" -mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." -myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." -mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." -netpass.exe,"Recover network passwords on Windows XP/2003/Vista." -nircmd.exe,"Do many useful tasks from command-line." -nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." -nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." -pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." -rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." -serviwin.exe,"displays the list of installed drivers and services on your system." -shexview.exe,"Displays the details of shell extensions installed on your computer." -shman.exe,"Lists all shortcuts on your desktop/start menu." -shmnview.exe,"Disable/enable static menu items in context menu of Explorer." -smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." -strun.exe,"Displays the list of all applications that are loaded on startup." -svcl.exe,"Sound volume command-line tool for Windows" -sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." -volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." -whosip.exe,"find all available information about an IP address from command-line." -winlister.exe,"This utility displays the list of opened windows on your system. " -wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." -zipinst.exe,"Install applications that do not provide an installation module." acm.zip,"ZIP Bundle for acm.exe" +AddrView.exe,"Extract URL addresses from HTML pages." addrview.zip,"ZIP Bundle for AddrView.exe" +AdvancedRun.exe,"Run a program with different settings that you choose." advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +AllThreadsView.exe,"Displays a list of all running threads in Windows" allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +AppAudioConfig.exe,"View/change audio settings of applications" appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.exe,"displays useful information about your network adapters." awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.exe,"view essential information about ActiveX components installed on your computer." axhelper.zip,"ZIP Bundle for axhelper.exe" +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +BluetoothCL.exe,"Show bluetooth devices list" bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +BulkFileChanger.exe,"Change date/time/attributes of multiple files." bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " chromepass.zip,"ZIP Bundle for ChromePass.exe" +CleanAfterMe.exe,"Clean files and Registry values in your system." cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +Clipboardic.exe,"Small and simple clipboard manager." clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +ControlMyMonitor.exe,"View and modify the settings of your monitor." controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" cports.zip,"ZIP Bundle for cports.exe" +CProcess.exe,"Displays the list of all processes currently running on your system." cprocess.zip,"ZIP Bundle for CProcess.exe" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +CredHistView.exe,"Decrypt the CREDHIST file of Windows" credhistview.zip,"ZIP Bundle for CredHistView.exe" +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." ctie.zip,"ZIP Bundle for ctie.exe" +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +DevManView.exe,"Alternative to the standard Device Manager of Windows." devmanview.zip,"ZIP Bundle for DevManView.exe" +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +Dialupass.exe,"NirSoft Dialupass utility." dialupass.zip,"ZIP Bundle for Dialupass.exe" +DiskCountersView.exe,"Show disk drive read/write counters." diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." dllexp.zip,"ZIP Bundle for dllexp.exe" +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +DownTester.exe,"Test your Internet download speed." downtester.zip,"ZIP Bundle for DownTester.exe" +DriveLetterView.exe,"View and change drive letter assignments " driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." driverview.zip,"ZIP Bundle for DriverView.exe" +DumpEDID.exe,"Dump EDID information into the console window." dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +ExtPassword.exe,"External Drive Password Recovery" extpassword.zip,"ZIP Bundle for ExtPassword.exe" +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." faview.zip,"ZIP Bundle for faview.exe" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +FileAccessErrorView.exe,"Displays file access error information" fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +FileTypesMan.exe,"Alternative to the File Types manager of Windows." filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +FlashCookiesView.exe,"View Flash cookies stored in your computer." flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +FolderChangesView.exe,"Monitor folder/drive changes." folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +FolderTimeUpdate.exe,"Updates the Modified Time of folders." foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.exe,"Scans your disk, and displays a report about each folder." folrep.zip,"ZIP Bundle for folrep.exe" +FreeSpaceLogView.exe,"View log of free disk space on Windows" freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." gacview.zip,"ZIP Bundle for gacview.exe" +GDIView.exe,"Displays the list of GDI handles opened by every process" gdiview.zip,"ZIP Bundle for GDIView.exe" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" getnir.zip,"ZIP Bundle for GetNir.exe" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" guipropview.zip,"ZIP Bundle for GUIPropView.exe" +HandleCountersView.exe,"Shows handle counter for every process" handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +HtmlAsText.exe,"Converts HTML documents to simple text files." htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +HtmlDocEdit.exe,"Simple HTML designer/editor" htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" iconsext.zip,"ZIP Bundle for iconsext.exe" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" iecv.zip,"ZIP Bundle for iecv.exe" +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." iehv.zip,"ZIP Bundle for iehv.exe" +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" iepv.zip,"ZIP Bundle for iepv.exe" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +InjectedDLL.exe,"Display the list of injected DLLs." injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +InstalledAppView.exe,"View installed Windows 10 apps" installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +InstalledPackagesView.exe,"Displays installed MSI packages on your system." installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +IPInfoOffline.exe,"view country information about IP addresses." ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +IPNetInfo.exe,"NirSoft IPNetInfo utility." ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +IPPathTableView.exe,"IP Path Table Viewer" ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.exe,"Displays the installed Java Runtime Environments." jrview.zip,"ZIP Bundle for jrview.exe" +jsae.exe,"Creates Javascript animation from image files on your local drive." jsae.zip,"ZIP Bundle for jsae.exe" +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +LANIPScanner.exe,"Local network scanner for Windows" lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +LastActivityView.exe,"View the latest computer activity." lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +LoadedDllsView.exe,"Displays all DLL files loaded on your system." loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +LostMyPassword.exe,"Password recovery tool for Windows" lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +MACAddressView.exe,"MAC address lookup tool" macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.exe,"Recovers email passwords" mailpv.zip,"ZIP Bundle for mailpv.exe" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." mdnsview.zip,"ZIP Bundle for mDNSView.exe" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." mmview.zip,"ZIP Bundle for mmview.exe" +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +MonitorInfoView.exe,"displays essential information about your monitor." monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" mspass.zip,"ZIP Bundle for mspass.exe" +MUICacheView.exe,"Edit/delete MUICache items in your system" muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." mweather.zip,"ZIP Bundle for mweather.exe" +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." myuninst.zip,"ZIP Bundle for myuninst.exe" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." mzcv.zip,"ZIP Bundle for mzcv.exe" +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." netpass.zip,"ZIP Bundle for netpass.exe" +NetResView.exe,"displays the list of all network resources on your LAN." netresview.zip,"ZIP Bundle for NetResView.exe" +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" networktools.zip,"ZIP Bundle for cports.exe" +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.exe,"Do many useful tasks from command-line." nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." nirext.zip,"ZIP Bundle for nirext.exe" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." nk2view.zip,"ZIP Bundle for nk2view.exe" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." officeins.zip,"ZIP Bundle for OfficeIns.exe" +OfflineRegistryFinder.exe,"Find data in external Registry files" offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +OfflineRegistryView.exe,"View offline Registry files" offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OpenSaveFilesView.exe,"Displays list of files that you previously opened." opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." openwithview.zip,"ZIP Bundle for OpenWithView.exe" +OperaCacheView.exe,"Cache viewer for Opera Web browser." operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +OperaPassView.exe,"Password recovery tool for Opera Web browser." operapassview.zip,"ZIP Bundle for OperaPassView.exe" +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +OutlookStatView.exe,"Display a general statistics of your Outlook emails." outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" outlooktools.zip,"ZIP Bundle for nk2edit.exe" passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" passrecpk.zip,"ZIP Bundle for mspass.exe" passrecview.zip,"ZIP Bundle for PassRecView.exe" +PasswordFox.exe,"View passwords stored in Firefox Web browser." passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordScan.exe,"Displays security information about passwords stored in your system." passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +PingInfoView.exe,"ping multiple host names and IP addresses." pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +ProcessActivityView.exe,"Show the file activity for selected process." processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +ProcessTCPSummary.exe,"Displays TCP connections summary" processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" produkey.zip,"ZIP Bundle for ProduKey.exe" progtools.zip,"ZIP Bundle for dllexp.exe" +PropertySystemView.exe,"View/edit file properties" propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." pspv.zip,"ZIP Bundle for pspv.exe" +PstPassword.exe,"Recover lost password of Outlook PST file." pstpassword.zip,"ZIP Bundle for PstPassword.exe" +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." rdpv.zip,"ZIP Bundle for rdpv.exe" +RecentFilesView.exe,"Display the list of recently opened files" recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." regdllview.zip,"ZIP Bundle for RegDllView.exe" +RegFileExport.exe,"Export offline Registry file to .reg file" regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" regscanner.zip,"ZIP Bundle for RegScanner.exe" regtools.zip,"ZIP Bundle for RegScanner.exe" +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +RouterPassView.exe,"Recover passwords from router config file." routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +RunAsDate.exe,"Run a program with the specified date." runasdate.zip,"ZIP Bundle for RunAsDate.exe" +RunFromProcess.exe,"Run a program from another process that you choose." runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +SafariHistoryView.exe,"History viewer for Safari Web browser" safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +SearchFilterView.exe,"view the search filters installed on your system." searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +SecurityQuestionsView.exe,"View Windows 10 security questions" securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.exe,"displays the list of installed drivers and services on your system." serviwin.zip,"ZIP Bundle for serviwin.exe" +ShadowCopyView.exe,"View shadow copies on your system" shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.exe,"Displays the details of shell extensions installed on your computer." shexview.zip,"ZIP Bundle for shexview.exe" +shman.exe,"Lists all shortcuts on your desktop/start menu." shman.zip,"ZIP Bundle for shman.exe" +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." shmnview.zip,"ZIP Bundle for shmnview.exe" +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +SiteShoter.exe,"Save a screenshot of any Web page into a file." siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +SkypeLogView.exe,"View log files created by Skype" skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." smsniff.zip,"ZIP Bundle for smsniff.exe" +SniffPass.exe,"capture the passwords that pass through your network adapter." sniffpass.zip,"ZIP Bundle for SniffPass.exe" +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +SpecialFoldersView.exe,"Easily jump to special folders in your system." specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.exe,"Displays the list of all applications that are loaded on startup." strun.zip,"ZIP Bundle for strun.exe" +svcl.exe,"Sound volume command-line tool for Windows" svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." sysexp.zip,"ZIP Bundle for sysexp.exe" systools.zip,"ZIP Bundle for ProduKey.exe" +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +TCPConnectProblemView.exe,"Monitor TCP connection problems." tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +TcpLogView.exe,"Monitors the opened TCP connections on your system." tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +TimeZonesView.exe,"Displays all world time zones." timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." uninstallview.zip,"ZIP Bundle for UninstallView.exe" +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +USBDeview.exe,"Lists all installed USB devices that you previously used." usbdeview.zip,"ZIP Bundle for USBDeview.exe" +USBDriveLog.exe,"USB Drive Log For Windows 10" usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" usblogview.zip,"ZIP Bundle for USBLogView.exe" +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" userassistview.zip,"ZIP Bundle for UserAssistView.exe" +UserProfilesView.exe,"View user profiles information on your system." userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +VNCPassView.exe,"Recover the passwords stored by the VNC tool." vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." volumouse.zip,"ZIP Bundle for volumouse.exe" +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +WebCamImageSave.exe,"Capture still images from your WebCam." webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +WhatIsHang.exe,"Get information about Windows software that hangs." whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.exe,"NirSoft WhoisTD utility." whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.exe,"find all available information about an IP address from command-line." whosip.zip,"ZIP Bundle for whosip.exe" +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +WinCrashReport.exe,"Displays a report about crashed Windows application." wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +WinDefLogView.exe,"Windows Defender Log Viewer" windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +WinFontsView.exe,"Display sample of all fonts installed on your system." winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.exe,"This utility displays the list of opened windows on your system. " winlister.zip,"ZIP Bundle for winlister.exe" +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +WinUpdatesView.exe,"Displays the history of Windows updates for your system." winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" +WirelessNetConsole.exe,"View wireless networks information (console application)" wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +WNetWatcher.exe,"Shows who is connected to your wireless network." wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." wul.zip,"ZIP Bundle for wul.exe" +zipinst.exe,"Install applications that do not provide an installation module." zipinst.zip,"ZIP Bundle for zipinst.exe" From e23dc4baa0ea9a0b005a4ccdd0974cb9199a9310 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 20:12:16 +0200 Subject: [PATCH 12/14] Update windows_nirsoft_tool_bundle_file_created.yml --- .../endpoint/windows_nirsoft_tool_bundle_file_created.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index d980ca8b3be..7e4a09118f1 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -19,8 +19,7 @@ search: | min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Endpoint.Filesystem - WHERE + FROM datamodel=Endpoint.Filesystem WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` [ From fe0c0e789fad3c161eb578785bfe2705e0f87d28 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 21:15:33 +0200 Subject: [PATCH 13/14] Update nirsoft_utilities_lookup.csv --- lookups/csv/nirsoft_utilities_lookup.csv | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv index d38974e2953..ba62fd11e72 100644 --- a/lookups/csv/nirsoft_utilities_lookup.csv +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -270,6 +270,8 @@ MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB por mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" MonitorInfoView.exe,"displays essential information about your monitor." monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaCacheView.exe,"Displays the list of files stored in the cache of Mozilla-based Web browsers." +mozillacacheview.zip,"ZIP Bundle for MozillaCacheView.exe" MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." MozillaHistoryView.exe,"Package of Web browser tools for Windows" mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" @@ -358,6 +360,8 @@ passrecpk.zip,"ZIP Bundle for mspass.exe" passrecview.zip,"ZIP Bundle for PassRecView.exe" PasswordFox.exe,"View passwords stored in Firefox Web browser." passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordHashesView.exe,"Displays the SHA1 and NTLM hashes of login passwords for currently logged-in users." +passwordhashesview.zip,"ZIP Bundle for PasswordHashesView.exe" PasswordScan.exe,"Displays security information about passwords stored in your system." passwordscan.zip,"ZIP Bundle for PasswordScan.exe" PingInfoView.exe,"ping multiple host names and IP addresses." @@ -396,6 +400,8 @@ RegFileExport.exe,"Export offline Registry file to .reg file" regfileexport.zip,"ZIP Bundle for RegFileExport.exe" RegFromApp.exe,"Creates .reg file according to Registry changes made by application." regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegHiveBackup.exe,"Backs up Registry files and user Registry hives to a specified folder." +reghivebackup.zip,"ZIP Bundle for RegHiveBackup.exe" RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" From 2bdef10e3fb8894fe9312a642a9000852f4ea713 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 21:25:50 +0200 Subject: [PATCH 14/14] Update windows_nirsoft_utilities.yml --- detections/endpoint/windows_nirsoft_utilities.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 4d1b02cbab0..5d5dd6628d8 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -14,7 +14,6 @@ description: | Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime