# Executables

### API Monitor v2 Alpha

Website: <http://www.rohitab.com/apimonitor\\>
Description: Tool to monitor API calls by applications\
Author: Rohitab Batra\
License:\
Version: v2r13\
Notes:

### Bintext

Website: <https://mcafee.com\\>
Description: Finds Ascii, Unicode, and Resource strings in a file\
Author: Mcafee\
License: Free\
Version: 3.03\
Notes:

### capa

Website: <https://github.com/mandiant/capa\\>
Description: FLARE tool to identify capabilities in executables\
Author: Mandiant\
License: Apache License 2.0 (<https://github.com/mandiant/capa/blob/master/LICENSE.txt)\\>
Version: 6.1.0\
Notes:

### Codetrack

Website: <https://www.getcodetrack.com\\>
Description: .NET Performance Profiler\
Author: Nico Van Goethem\
License: Freeware (see the About section in the application)\
Version: 1.0.3.3\
Notes: No longer maintained

### Cutter

Website: <https://github.com/rizinorg/cutter\\>
Description: Reverse Engineering Platform powered by rizin\
Author: Rizin Organization\
License: GNU General Public License v3 (<https://github.com/rizinorg/cutter/blob/dev/COPYING)\\>
Version: 2.3.2\
Notes:

### Decompyle3

Website: <https://github.com/rocky/python-decompile3/\\>
Description: Python3 bytecode decompiler\
Author: Rocky R. Bernstein\
License: GNU General Public License v3 (<https://github.com/rocky/python-decompile3/blob/master/COPYING)\\>
Version: 3.9.0\
Notes:

### densityscout

Website: <https://cert.at\\>
Description: Tool to identify entropy within files\
Author: Christian Wojner / CERT.at (<https://cert.at/en/about-us/overview/)\\>
License: Internet Software Consortium License (ISCL - <https://cert.at/en/downloads/software/software-densityscout)\\>
Version: Build 45\
Notes:

### DIE (Detect It Easy)

Website: <https://github.com/horsicq/DIE-engine\\>
Description: Reverse Engineering Engine\
Author: Hors (horsicq)\
License: MIT License (<https://github.com/horsicq/DIE-engine/blob/master/LICENSE)\\>
Version: 3.08\
Notes: Detect It Easy - DIE

### dotPeek

Website: <https://www.jetbrains.com\\>
Description: .NET Decompiler and Assembly Browser\
Author: JetBrains\
License: EULA (<https://www.jetbrains.com/legal/docs/toolbox/license\\_personal/)\\>
Version: 2023.2.2\
Notes:

### exeinfope

Website: <https://github.com/ExeinfoASL/ASL\\>
Description: EXE, Packer, Compiler detection\
Author: ExeinfoASL\
License: None Listed\
Version: 0.0.8.1\
Notes:

### File Insight

Website: <https://www.trellix.com\\>
Description: Static file analysis tool\
Author: McAfee / Trellix\
License: Software Royalty-Free License (<https://www.trellix.com/en-us/downloads/free-tools/terms-of-use.html)\\>
Version: 3.0\
Notes:

### FLOSS (FLARE Obfuscated String Solver)

Website: <https://github.com/mandiant/flare-floss\\>
Description: Extract obfuscated strings from malware\
Author: Mandiant\
License: Apache License v2.0 (<https://github.com/mandiant/flare-floss/blob/master/LICENSE.txt)\\>
Version: 2.3.0\
Notes:

### hollows\_hunter

Website: <https://github.com/hasherezade/hollows\\_hunter\\>
Description: Scans running processes for implants and dumps them if found\
Author: hasherezade\
License: BSD 2-Clause Simplified License (<https://github.com/hasherezade/hollows\\_hunter/blob/master/LICENSE)\\>
Version: 0.3.6\
Notes:

### IDA Free

Website: <https://hex-rays.com/ida-free\\>
Description: Binary analysis tool for x86/x64 applications\
Author: hex-rays\
License: Free for Educational, Personal, and non-Commercial use\
Version: 8.3\
Notes:

### ilspy

Website: <https://github.com/icsharpcode/ilspy\\>
Description: .NET Decompiler\
Author: ICSharpCode (<https://github.com/orgs/icsharpcode/people)\\>
License: MIT License (<https://github.com/icsharpcode/ILSpy/blob/master/doc/ILSpyAboutPage.txt)\\>
Version: 8.1.1.7464\
Notes:

### KsDumper 11

Website: <https://github.com/mastercodeon314/KsDumper-11\\>
Description: Kernel Space Dumper utility\
Author: mastercodeon314\
License: None at this time\
Version: 1.0\
Notes:

### MagnetProcessCapture

Website: <https://magnetforensics.com\\>
Description: Tool to dump a running process\
Author: Magnet Forensics\
License: EULA\
Version: v13\
Notes:

### MalCat

Website: <https://malcat.fr\\>
Description: Malware Analysis Tool\
Author: Malcat EL\
License: <https://malcat.fr/index.html#faq6\\>
Version: 0.9.3\
Notes:

### mal\_unpack

Website: <https://github.com/hasherezade/mal\\_unpack\\>
Description: Dynamic unpacker based on PE-sieve\
Author: hasherezade\
License: BSD 2-Clause Simplified License (<https://github.com/hasherezade/mal\\_unpack/blob/master/LICENSE)\\>
Version: 0.9.7\
Notes:

### Noriben

Website: <https://github.com/rurik/noriben\\>
Description: Malware Analysis Sandbox based on Python\
Author: Brian Baskin (Rurik)\
License: Apache License v2 (<https://github.com/Rurik/Noriben/blob/master/LICENSE)\\>
Version: 1.8.7\
Notes:

### NTCore Explorer Suite

Website: <https://ntcore.com\\>
Description: PE Analysis tool suite\
Author: Erik Pistelli\
License:\
Version: IV\
Notes:

### PE-bear

Website: <https://github.com/hasherezade/pe-bear\\>
Description: Portable Executable reversing tool with a GUI\
Author: hasherezade\
License: GNU General Public License v2 (<https://github.com/hasherezade/pe-bear/blob/main/LICENSE)\\>
Version: 0.6.5.2\
Notes:

### PEiD

Website: <https://github.com/wolfram77web/app-peid\\>
Description: Portable Executable identifier\
Author: snaker / Qwerton / Jibz\
License: All Rights Reserved\
Version: 0.95\
Notes:

### pe-sieve

Website: <https://github.com/hasherezade/pe-sieve\\>
Description: Scans a process and dumps possible implants\
Author: hasherezade\
License: BSD 2-Clause Simplified License (<https://github.com/hasherezade/pe-sieve/blob/master/LICENSE)\\>
Version: 0.3.6\
Notes:

### PEStudio

Website: <https://www.winitor.com\\>
Description: PE Analysis Tool\
Author: Marc Ochsenmeier\
License: As-Is, without warranty (<https://www.winitor.com/tools/pestudio/changes.log)\\>
Version: 9.53\
Notes:

### pev

Website: <https://github.com/mentebinaria/readpe\\>
Description: PE Analysis toolkit\
Author: Fernando Merces\
License: GNU General Public License v2.0 (<https://github.com/mentebinaria/readpe/blob/master/LICENSE)\\>
Version: 0.82\
Notes:

### PortexAnalyzer GUI

Website: <https://github.com/struppigel/PortexAnalyzerGUI\\>
Description: GUI for PortEx, a Portable Executable and Malware Analysis Library\
Author: Karsten Hahn\
License: Apache License 2.0 (<https://github.com/struppigel/PortexAnalyzerGUI/blob/main/LICENSE)\\>
Version: 0.12.12\
Notes:

### PPEE (puppy)

Website: <https://www.mzrst.com/\\>
Description: Professional PE file Explorer\
Author: Zaderostam\
License:\
Version: 1.12\
Notes:

### ProcDOT

Website: <https://www.procdot.com\\>
Description: Visual analysis of Windows-based malware\
Author: Christian Wojner\
License: Internet Systems Consortium (ISC - <https://www.procdot.com/faqs.htm>, <https://www.procdot.com/webhelp/index.html?license.htm)\\>
Version: 1.22 (build 57)\
Notes: Requires Windows Graphviz and Windump/TCPDump, but Windump/TCPDump are not supported on Win10+

### Process Hacker

Website: <https://processhacker.sourceforge.io\\>
Description: Process analysis and dumping tool\
Author: Steven G (dmex) / Wen Jia Liu / WinSiderss\
License: GNU General Public License v3 - <https://processhacker.sourceforge.io/gpl.php\\>
Version: 2.39.0.124\
Notes:

### PSDecode

Website: <https://github.com/CyberCentreCanada/assemblyline-service-overpower\\>
Description: Powershell script to deobfuscate encoded Powershell scripts\
Author: R3MRUM / CyberCentreCanada\
License:\
Version: 5.0\
Notes:

### Rehex (Reverse Engineers' Hex Editor)

Website: <https://github.com/solemnwarning/rehex\\>
Description: Hex Editor with useful tools for Reverse Engineering\
Author: Daniel Collins\
License: GNU General Public License v2 (<https://github.com/solemnwarning/rehex/blob/master/LICENSE.txt)\\>
Version: 0.60.1\
Notes:

### Resource Hacker

Website: <http://www.angusj.com/resourcehacker\\>
Description: Compiler and Decompiler for Windows applications\
Author: Angus Johnson\
License: Freeware (<http://www.angusj.com/resourcehacker> - License to Use)\
Version: 5.2.1\
Notes:

### scdbg

Website: <http://sandsprite.com/blogs/index.php?uid=7\\&pid=152\\>
Description: Shellcode analysis tool\
Author: David Zimmer\
License:\
Version: Jul 10 2023 14:21:55\
Notes:

### Scylla

Website: <https://github.com/ntquery/scylla\\>
Description: Imports Reconstructor written in C/C++\
Author: NtQuery\
License: GNU General Public License v3 (<https://github.com/NtQuery/Scylla/blob/master/LICENSE)\\>
Version: 0.9.8\
Notes: May not work well on later versions of Windows 10 and any version of Windows 11

### setdllcharacteristics

Website: <https://blog.didierstevens.com/2010/10/17/setdllcharacteristics/\\>
Description: Manually edit the characteristics of DLL's\
Author: Didier Stevens\
License: Public Domain\
Version: 0.0.0.1\
Notes:

### Total PE 2

Website: <https://github.com/zodiacon/TotalPE2\\>
Description: PE Viewer\
Author: Pavel Yosifovich\
License: MIT License (<https://github.com/zodiacon/TotalPE2/blob/master/LICENSE.txt)\\>
Version: 0.6.5.0\
Notes:

### TrID

Website: <https://mark0.net/soft-trid-e.html\\>
Description: File identifier based on their binary signatures\
Author: Marco Pontello\
License: Free for personal / non-commercial use\
Version: 2.2.4\
Notes:

### UPX

Website: <https://github.com/upx/upx\\>
Description: The Ultimate Packer for eXecutables\
Author: Markus Oberhumer, Laszlo Molnar, John Reiser\
License: Multiple Licenses (<https://github.com/upx/upx/blob/devel/LICENSE)\\>
Version: 4.1.0\
Notes:

### VB-Decompiler

Website: <https://www.vb-decompiler.org\\>
Description: Visual Basic Decompiler\
Author: DotFix Software\
License: <https://www.vb-decompiler.org/license.htm\\>
Version: 12.2\
Notes:

### WinDbg

Website: <https://www.microsoft.com\\>
Description: Windows Debugger\
Author: Microsoft\
License: Third-party notices within app\
Version: 1.2308.2002.0\
Notes: Installed via winget

### Windows Sandbox

Website: <https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview\\>
Description: Windows-based Sandbox Environment\
Author: Microsoft\
License:\
Version: 10.0.19041.985\
Notes:

### x64dbg

Website: <https://sourceforge.net/projects/x64dbg/\\>
Description: Open Source x64/x32 debugger for Windows\
Author: Duncan Ogilvie (mrexodia)\
License: GNU General Public License v3 (<https://github.com/x64dbg/x64dbg/blob/development/LICENSE)\\>
Version: 2023-11-18\_02-28\
Notes: