# Executables

### API Monitor v2 Alpha

Website: <http://www.rohitab.com/apimonitor\\>
Description: Tool to monitor API calls by applications\
Author: Rohitab Batra\
License:\
Version: v2r13\
Notes:

### Bintext

Website: <https://mcafee.com\\>
Description: Finds Ascii, Unicode, and Resource strings in a file\
Author: Mcafee\
License: Free\
Version: 3.03\
Notes:

### capa

Website: <https://github.com/mandiant/capa\\>
Description: FLARE tool to identify capabilities in executables\
Author: Mandiant\
License: Apache License 2.0 (<https://github.com/mandiant/capa/blob/master/LICENSE.txt)\\>
Version: 6.1.0\
Notes:

### Codetrack

Website: <https://www.getcodetrack.com\\>
Description: .NET Performance Profiler\
Author: Nico Van Goethem\
License: Freeware (see the About section in the application)\
Version: 1.0.3.3\
Notes: No longer maintained

### Cutter

Website: <https://github.com/rizinorg/cutter\\>
Description: Reverse Engineering Platform powered by rizin\
Author: Rizin Organization\
License: GNU General Public License v3 (<https://github.com/rizinorg/cutter/blob/dev/COPYING)\\>
Version: 2.3.2\
Notes:

### Decompyle3

Website: <https://github.com/rocky/python-decompile3/\\>
Description: Python3 bytecode decompiler\
Author: Rocky R. Bernstein\
License: GNU General Public License v3 (<https://github.com/rocky/python-decompile3/blob/master/COPYING)\\>
Version: 3.9.0\
Notes:

### densityscout

Website: <https://cert.at\\>
Description: Tool to identify entropy within files\
Author: Christian Wojner / CERT.at (<https://cert.at/en/about-us/overview/)\\>
License: Internet Software Consortium License (ISCL - <https://cert.at/en/downloads/software/software-densityscout)\\>
Version: Build 45\
Notes:

### DIE (Detect It Easy)

Website: <https://github.com/horsicq/DIE-engine\\>
Description: Reverse Engineering Engine\
Author: Hors (horsicq)\
License: MIT License (<https://github.com/horsicq/DIE-engine/blob/master/LICENSE)\\>
Version: 3.08\
Notes: Detect It Easy - DIE

### dotPeek

Website: <https://www.jetbrains.com\\>
Description: .NET Decompiler and Assembly Browser\
Author: JetBrains\
License: EULA (<https://www.jetbrains.com/legal/docs/toolbox/license\\_personal/)\\>
Version: 2023.2.2\
Notes:

### exeinfope

Website: <https://github.com/ExeinfoASL/ASL\\>
Description: EXE, Packer, Compiler detection\
Author: ExeinfoASL\
License: None Listed\
Version: 0.0.8.1\
Notes:

### File Insight

Website: <https://www.trellix.com\\>
Description: Static file analysis tool\
Author: McAfee / Trellix\
License: Software Royalty-Free License (<https://www.trellix.com/en-us/downloads/free-tools/terms-of-use.html)\\>
Version: 3.0\
Notes:

### FLOSS (FLARE Obfuscated String Solver)

Website: <https://github.com/mandiant/flare-floss\\>
Description: Extract obfuscated strings from malware\
Author: Mandiant\
License: Apache License v2.0 (<https://github.com/mandiant/flare-floss/blob/master/LICENSE.txt)\\>
Version: 2.3.0\
Notes:

### hollows\_hunter

Website: <https://github.com/hasherezade/hollows\\_hunter\\>
Description: Scans running processes for implants and dumps them if found\
Author: hasherezade\
License: BSD 2-Clause Simplified License (<https://github.com/hasherezade/hollows\\_hunter/blob/master/LICENSE)\\>
Version: 0.3.6\
Notes:

### IDA Free

Website: <https://hex-rays.com/ida-free\\>
Description: Binary analysis tool for x86/x64 applications\
Author: hex-rays\
License: Free for Educational, Personal, and non-Commercial use\
Version: 8.3\
Notes:

### ilspy

Website: <https://github.com/icsharpcode/ilspy\\>
Description: .NET Decompiler\
Author: ICSharpCode (<https://github.com/orgs/icsharpcode/people)\\>
License: MIT License (<https://github.com/icsharpcode/ILSpy/blob/master/doc/ILSpyAboutPage.txt)\\>
Version: 8.1.1.7464\
Notes:

### KsDumper 11

Website: <https://github.com/mastercodeon314/KsDumper-11\\>
Description: Kernel Space Dumper utility\
Author: mastercodeon314\
License: None at this time\
Version: 1.0\
Notes:

### MagnetProcessCapture

Website: <https://magnetforensics.com\\>
Description: Tool to dump a running process\
Author: Magnet Forensics\
License: EULA\
Version: v13\
Notes:

### MalCat

Website: <https://malcat.fr\\>
Description: Malware Analysis Tool\
Author: Malcat EL\
License: <https://malcat.fr/index.html#faq6\\>
Version: 0.9.3\
Notes:

### mal\_unpack

Website: <https://github.com/hasherezade/mal\\_unpack\\>
Description: Dynamic unpacker based on PE-sieve\
Author: hasherezade\
License: BSD 2-Clause Simplified License (<https://github.com/hasherezade/mal\\_unpack/blob/master/LICENSE)\\>
Version: 0.9.7\
Notes:

### Noriben

Website: <https://github.com/rurik/noriben\\>
Description: Malware Analysis Sandbox based on Python\
Author: Brian Baskin (Rurik)\
License: Apache License v2 (<https://github.com/Rurik/Noriben/blob/master/LICENSE)\\>
Version: 1.8.7\
Notes:

### NTCore Explorer Suite

Website: <https://ntcore.com\\>
Description: PE Analysis tool suite\
Author: Erik Pistelli\
License:\
Version: IV\
Notes:

### PE-bear

Website: <https://github.com/hasherezade/pe-bear\\>
Description: Portable Executable reversing tool with a GUI\
Author: hasherezade\
License: GNU General Public License v2 (<https://github.com/hasherezade/pe-bear/blob/main/LICENSE)\\>
Version: 0.6.5.2\
Notes:

### PEiD

Website: <https://github.com/wolfram77web/app-peid\\>
Description: Portable Executable identifier\
Author: snaker / Qwerton / Jibz\
License: All Rights Reserved\
Version: 0.95\
Notes:

### pe-sieve

Website: <https://github.com/hasherezade/pe-sieve\\>
Description: Scans a process and dumps possible implants\
Author: hasherezade\
License: BSD 2-Clause Simplified License (<https://github.com/hasherezade/pe-sieve/blob/master/LICENSE)\\>
Version: 0.3.6\
Notes:

### PEStudio

Website: <https://www.winitor.com\\>
Description: PE Analysis Tool\
Author: Marc Ochsenmeier\
License: As-Is, without warranty (<https://www.winitor.com/tools/pestudio/changes.log)\\>
Version: 9.53\
Notes:

### pev

Website: <https://github.com/mentebinaria/readpe\\>
Description: PE Analysis toolkit\
Author: Fernando Merces\
License: GNU General Public License v2.0 (<https://github.com/mentebinaria/readpe/blob/master/LICENSE)\\>
Version: 0.82\
Notes:

### PortexAnalyzer GUI

Website: <https://github.com/struppigel/PortexAnalyzerGUI\\>
Description: GUI for PortEx, a Portable Executable and Malware Analysis Library\
Author: Karsten Hahn\
License: Apache License 2.0 (<https://github.com/struppigel/PortexAnalyzerGUI/blob/main/LICENSE)\\>
Version: 0.12.12\
Notes:

### PPEE (puppy)

Website: <https://www.mzrst.com/\\>
Description: Professional PE file Explorer\
Author: Zaderostam\
License:\
Version: 1.12\
Notes:

### ProcDOT

Website: <https://www.procdot.com\\>
Description: Visual analysis of Windows-based malware\
Author: Christian Wojner\
License: Internet Systems Consortium (ISC - <https://www.procdot.com/faqs.htm>, <https://www.procdot.com/webhelp/index.html?license.htm)\\>
Version: 1.22 (build 57)\
Notes: Requires Windows Graphviz and Windump/TCPDump, but Windump/TCPDump are not supported on Win10+

### Process Hacker

Website: <https://processhacker.sourceforge.io\\>
Description: Process analysis and dumping tool\
Author: Steven G (dmex) / Wen Jia Liu / WinSiderss\
License: GNU General Public License v3 - <https://processhacker.sourceforge.io/gpl.php\\>
Version: 2.39.0.124\
Notes:

### PSDecode

Website: <https://github.com/CyberCentreCanada/assemblyline-service-overpower\\>
Description: Powershell script to deobfuscate encoded Powershell scripts\
Author: R3MRUM / CyberCentreCanada\
License:\
Version: 5.0\
Notes:

### Rehex (Reverse Engineers' Hex Editor)

Website: <https://github.com/solemnwarning/rehex\\>
Description: Hex Editor with useful tools for Reverse Engineering\
Author: Daniel Collins\
License: GNU General Public License v2 (<https://github.com/solemnwarning/rehex/blob/master/LICENSE.txt)\\>
Version: 0.60.1\
Notes:

### Resource Hacker

Website: <http://www.angusj.com/resourcehacker\\>
Description: Compiler and Decompiler for Windows applications\
Author: Angus Johnson\
License: Freeware (<http://www.angusj.com/resourcehacker> - License to Use)\
Version: 5.2.1\
Notes:

### scdbg

Website: <http://sandsprite.com/blogs/index.php?uid=7\\&pid=152\\>
Description: Shellcode analysis tool\
Author: David Zimmer\
License:\
Version: Jul 10 2023 14:21:55\
Notes:

### Scylla

Website: <https://github.com/ntquery/scylla\\>
Description: Imports Reconstructor written in C/C++\
Author: NtQuery\
License: GNU General Public License v3 (<https://github.com/NtQuery/Scylla/blob/master/LICENSE)\\>
Version: 0.9.8\
Notes: May not work well on later versions of Windows 10 and any version of Windows 11

### setdllcharacteristics

Website: <https://blog.didierstevens.com/2010/10/17/setdllcharacteristics/\\>
Description: Manually edit the characteristics of DLL's\
Author: Didier Stevens\
License: Public Domain\
Version: 0.0.0.1\
Notes:

### Total PE 2

Website: <https://github.com/zodiacon/TotalPE2\\>
Description: PE Viewer\
Author: Pavel Yosifovich\
License: MIT License (<https://github.com/zodiacon/TotalPE2/blob/master/LICENSE.txt)\\>
Version: 0.6.5.0\
Notes:

### TrID

Website: <https://mark0.net/soft-trid-e.html\\>
Description: File identifier based on their binary signatures\
Author: Marco Pontello\
License: Free for personal / non-commercial use\
Version: 2.2.4\
Notes:

### UPX

Website: <https://github.com/upx/upx\\>
Description: The Ultimate Packer for eXecutables\
Author: Markus Oberhumer, Laszlo Molnar, John Reiser\
License: Multiple Licenses (<https://github.com/upx/upx/blob/devel/LICENSE)\\>
Version: 4.1.0\
Notes:

### VB-Decompiler

Website: <https://www.vb-decompiler.org\\>
Description: Visual Basic Decompiler\
Author: DotFix Software\
License: <https://www.vb-decompiler.org/license.htm\\>
Version: 12.2\
Notes:

### WinDbg

Website: <https://www.microsoft.com\\>
Description: Windows Debugger\
Author: Microsoft\
License: Third-party notices within app\
Version: 1.2308.2002.0\
Notes: Installed via winget

### Windows Sandbox

Website: <https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview\\>
Description: Windows-based Sandbox Environment\
Author: Microsoft\
License:\
Version: 10.0.19041.985\
Notes:

### x64dbg

Website: <https://sourceforge.net/projects/x64dbg/\\>
Description: Open Source x64/x32 debugger for Windows\
Author: Duncan Ogilvie (mrexodia)\
License: GNU General Public License v3 (<https://github.com/x64dbg/x64dbg/blob/development/LICENSE)\\>
Version: 2023-11-18\_02-28\
Notes:


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://digitalsleuth.gitbook.io/win-for-documentation/the-tools/executables.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.