__philippe's favorites (71)

PEAnatomist shows almost all known data structures inside a PE file and makes some analytics.
Current version provides an entropy histogram possibly handy for cursory PE forensics

PPEE (Professional PE file Explorer) allows analysis of malformed and crafted PE files, making it handy for reverse-engineering, malware researchers and more. The program includes PE Export, Import, Resource, Exception, Certificate (relies on Windows API), Base Relocation, Debug, TLS, Load Config, Bound Import, IAT, Delay Import and CLR.

The program includes a HEX editor and supports Virustotal and OPSWAT's Metadefender query reports.

CSVed is a fast, basic spreadsheet file editor that supports the CSV file format. You can add/delete columns, rearrange column order, change separator, filter items, remove duplicates, split/join columns etc.

CountryTraceRoute helps to diagnose the path and delay of information across the internet. The program is similar to the command-line tracert but much faster. CountryTraceRoute also displays the country of the owner of every IP address found in the traceroute, and ASN Network Carrier information per hop.

After the traceroute is completed, you can select all items (Ctrl+A) and then save them into csv/tab-delimited/html/xml file with 'Save Selected Items' option (Ctrl+S) or copy them to the clipboard (Ctrl+C) and then paste the result into Excel or other spreadsheet application.

MobileFileSearch allows you to search files inside a mobile device (Smartphone or Tablet) plugged to the USB port on your computer, with Media Transfer Protocol (MTP). You can search files by their size, their created time, their modified time, or their name (using wildcard).

After finding the files, you can optionally delete them, copy them to a folder on your computer, or export the files list to CSV/tab-delimited/HTML/XML/JSON file.

AppNetworkCounter counts and displays the data sent and received by individual applications on your system, a great way to see historical usage and monitor resource hogs. For every application, you can see the number of sent and received bytes, packets, IPv4, and IPv6 bytes. Functional for both TCP and UDP.

The program also displays the version information of the application - Product Name, Product Version, File Description and Company Name.

RegistryChangesView allows you to take a snapshot of Windows Registry and later compare it with the current Registry, Registry files stored in a shadow copy created by Windows, or other snapshots. When comparing two snapshots, exact changes are displayed, with optional export of the changes into a standard .reg file.

Core Temp is a small footprint yet powerful program to monitor processor temperature and other vital system information. The program can track temperatures on individual processor cores, useful for advanced diagnostics or checking that cooling tools are functioning properly.

DNSQuerySniffer is a network sniffer utility that shows the DNS queries sent from your system. For every DNS query, the following information is displayed: Host Name, Port Number, Query ID, Request Type (A, AAAA, NS, MX and so on), Request Time, Response Time, Duration, Response Code, Number of records and the content of the returned DNS records.

You can easily export the DNS queries information to csv/tab-delimited/xml/html file, or copy the DNS queries to the clipboard and then, paste them into Excel or other spreadsheet application.