v1.2.1-beta

• Changed part of the ui, giving it a style that felt more comfortable to me while also adding some easy-to-understand features.

• Improved the digital signature detector, it can now detect copied files as TAMPERED as well, making it easier to identify files that have been modified or duplicated.

• Improved the file information section by adding a timeline graph with timestamps. it also shows if a replace occurred, making it much easier to sort through and filter the information.

• Added multiline support, meaning you can now select multiple files at once and copy their paths directly.

• Improved the design of the replace popup, giving it a cleaner square-based style that makes the difference much more noticeable compared to the previous version.

• The latest addition is a strings analyzer along with some other features. this allows you to directly check what a program contains in a simplified way, mainly focused on strings, somewhat similar to Detect It Easy. more features will be added in the future, such as import analysis, etc.

v1.2-beta

its gonna be a beta version, there's still a lot more stuff i wanna add, i'll still be mentioning the new changes as i add them, and i'll make another post with everything once the final version is out

• added a new checkbox to filescan, it now detects if a file is actually a dll, so if a .dll gets renamed u'll still know what it really is instead of only filtering .dll files, which wasnt really the best way to do it.

• added file sizes, so if for some reason my signature detection fails (which i doubt), u can still tell if the file exists just by looking at its size, if its way too big or too small depending on the program, etc.

• improved the performance a lot, now if the tool is minimized it basically uses nothing, it also parses way faster without using a ton of resources like prefetchview does while parsing. u'll probably see this in my future tools and updates too, bc i wanna make ssing more efficient while also making sure the user's pc doesnt lag. this part is still being worked on tho, i think i can improve it even more.

• i honestly think this is the best thing i added, basically if u right click a row, or more specifically the file path, u'll see a new option called "show file information". it'll open a journal for that specific file, so there's no need to go into journaltrace anymore. it'll also tell u if the file got renamed or moved to another directory. idk how to really explain it, but once u try it u'll understand what i mean. if u guys think the window is too small or hard to read lmk and i might change it so it looks better.

• added more yara rules CH1

v1.1

• More processes and services were added: PcaSvc, DcomLaunch, DPS, and Explorer, each of these focuses on specific strings, here’s what each one looks for:

  • DPS: searches for .exe files and replacements marked with !! and ext modif too
  • PcaSvc: searches for .ahk, .jar, and .bat
  • DcomLaunch: searches for -jar "path.jar" (only the path.jar will be shown)
  • Explorer: shows pcaclient and .bat

• FileScan was updated and can now internally analyze whether a file is a DLL

• A new checkbox and column were added to FileScan, making it easier to search for DLLs only

• Unicode character support was added. It does not support every character due to current limitations

• The new services and processes only include the checkboxes and columns that are actually useful for them, based on what each one needs to show

v1.0

• I added a UI, look the video: https://youtu.be/gitAgVySUqU

v0.1.1

• Fixed the issue where it wasn't detecting paths in the dump with system informer

v0.1

first release