This tool shows you the accesses the user or group you specify has to files, Registry keys or Windows services.

This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.

Active Directory Explorer is an advanced Active Directory (AD) viewer and editor.

Undelete Server 2003 Active Directory objects.

Bypass password screen during logon.

See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.

Autorunsc is the command-line version of Autoruns.

This fully-configurable program automatically generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.

CacheSet is a program that allows you to control the Cache Manager's working set size using functions provided by NT. It's compatible with all versions of NT.

View the resolution of the system clock, which is also the maximum timer resolution.

Use Contig to optimize individual files, or to create new files that are contiguous.

Coreinfo is a command-line utility that shows you the mapping between logical processors and the physical processor, NUMA node, and socket on which they reside, as well as the cache’s assigned to each logical processor.

This is a kernel-mode driver that demonstrates keyboard input filtering just above the keyboard class driver in order to turn caps-locks into control keys. Filtering at this level allows conversion and hiding of keys before NT even "sees" them. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue-screen.

Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.

This new utility enables you to create up to four virtual desktops and to use a tray interface or hotkeys to preview what’s on each desktop and easily switch between them.

View disk usage by directory.

Disk2vhd is a utility that creates VHD (Virtual Hard Disk - Microsoft’s Virtual Machine disk format) versions of physical disks for use in Microsoft Virtual PC or Microsoft Hyper-V virtual machines (VMs).

Display volume disk-mappings.

This utility captures all hard disk activity or acts like a software disk activity light in your system tray.

Graphical disk sector utility.

View information for encrypted files.

FindLinks reports the file index and any hard links (alternate file paths on the same volume) that exist for the specified file.

This handy command-line utility will show you what files are open by which processes, and much more.

Convert hex numbers to decimal and vice versa.

AD Insight is an LDAP (Light-weight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications.

Create Win2K NTFS symbolic links.

Dump the contents of the Logical Disk Manager"s on-disk database, which describes the partitioning of Windows 2000 Dynamic disks.

List all the DLLs that are currently loaded, including where they are loaded and their version numbers. Version 2.0 prints the full path names of loaded modules.

Use Microsoft kernel debuggers to examine a live system.

See the order in which devices are loaded on your WinNT/2K system.

List active logon sessions.

Schedule file rename and delete commands for the next reboot. This can be useful for cleaning stubborn or in-use malware files.

Notmyfault is a tool that you can use to crash, hang, and cause kernel memory leaks on your Windows system.

Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.

Defragment your paging files and Registry hives!

See what files are scheduled for delete or rename the next time the system boots.

Displays the named pipes on your system, including the number of maximum instances and active instances for each pipe.

Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.

ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike.

Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.

Monitor file system, Registry, process, thread and DLL activity in real-time.

Execute processes remotely.

See what files are opened remotely.

Displays the SID of a computer or a user.

Obtain information about a system.

Terminate local or remote processes.

Show information about processes and threads.

Show users logged on to a system.

Dump event log records.

Changes account passwords.

Measure network performance.

View and control services.

Shuts down and optionally reboots a computer

Suspend and resume processes.

RAMMap is an advanced physical memory usage analysis utility for Windows Vista and higher.

Scan for and delete Registry keys that contain embedded null-characters that are otherwise undeleteable by standard Registry-editing tools.

Ru (registry usage) reports the registry space usage for the registry key you specify. By default it recurses subkeys to show the total size of a key and its subkeys.

Jump to the registry path you specify in Regedit.

RDCMan manages multiple remote desktop connections. It is useful for managing server labs where you need regular access to each machine such as automated checkin systems and data centers.

Scan your system for rootkit-based malware.

Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program.

Scan file shares on your network and view their security settings to close security holes.

Launch programs as a different user via a convenient shell context-menu entry.

Dump file version information and verify that images on your system are digitally signed.

Reveal NTFS alternate streams.

Search for ANSI and UNICODE strings in binary images.

Flush cached data to disk.

System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time.

TCP/UDP endpoint viewer

Detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.

See a breakdown of a process's committed virtual memory types as well as the amount of physical memory (working set) assigned by the operating system to those types. Identify the sources of process memory usage and the memory cost of application features.

Set Volume ID of FAT or NTFS drives.

See who owns an Internet address.

The ultimate Object Manager namespace viewer is here.

Presentation utility for zooming and drawing on the screen.

This utility allows you to easily disable/enable ActiveX components on Internet Explorer browser.

ActiveXHelper is a small utility that allows you to view essential information about ActiveX components installed on your computer. You can view the entire (and very large !) list of ActiveX components by loading it from HKEY_CLASSES_ROOT\CLSID Registry key, or alternatively, display only the ActiveX components that you specify. In addition, you can temporarily disable specific ActiveX components. When ActiveX components are disabled, they cannot be used by any software, until you enable them again.

AdapterWatch displays useful information about your network adapters: IP addresses, Hardware address, WINS servers, DNS servers, MTU value, Number of bytes received or sent, The current transfer speed, and more. In addition, it displays general TCP/IP/UDP/ICMP statistics for your local computer.

AddrView allows you to parse HTML pages and extract most URL addresses stored in them. AddrView extracts URLs of images (<img> tag), links to other files (<a> tag), CSS files, frames, Flash files, and more.

AdvancedRun is a simple tool for Windows that allows you to run a program with different settings that you choose, including - low or high priority, start directory, main window state (Minimized/Maximized), run the program with different user or permissions, Operating system compatibility settings, and environment variables.

AllThreadsView is a simple tool that displays a list of all running threads from all processes on your system in one table. For every thread, the following information is displayed: Thread ID, Creation Time, Kernel Time, User Time, Duration, Start Address, Priority, Base Priority, Context Switch Count, Context Switch Change (Since the last refresh), Wait Reason, Process ID, Process Path.

AlternateStreamView is a small utility that allows you to scan your NTFS drive, and find all hidden alternate streams stored in the file system. After scanning and finding the alternate streams, you can extract these streams into the specified folder, delete unwanted streams, or save the streams list into text/html/csv/xml file.

AltStreamDump is a console application that dumps the list of NTFS alternate streams found in the current directory.

This tool displays your current audio settings of every application on your system, and allows you to easily change the setting of multiple applications at once. You can change the mute/unmute status, the sound volume level, and the right/left audio balance of the application.

AppCompatibilityView is a simple tool that displays the list of all programs that run with different compatibility settings, stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers keys. It also allows you to easily modify or delete the compatibility settings of multiple applications at once.

AppCrashView is a small utility for Windows Vista and Windows 7 that displays the details of all application crashes occurred in your system. The crashes information is extracted from the .wer files created by the Windows Error Reporting (WER) component of the operating system every time that a crash is occurred.

AppNetworkCounter is a simple tool counts and displays the number of TCP/UDP bytes and packets sent and received by every application on your system. For every application, the following information is displayed: the number of sent and received bytes, number of sent and received packets, number of sent/received IPv4 bytes, and number of sent/received IPv6 bytes. It also displays the version information of the application - Product Name, Product Version, File Description, and Company Name.

AppReadWriteCounter is a tool that counts and displays the current file read/write operations of every application running on your system. It displays the number of read/write bytes, the number of read/write operations, current calculated read/write speed, and the details about the application (product name, product version, and so on) that makes the file read/write operations.

AppResourcesUsageView extracts and displays the application resources usage information stored in the SRUDB.dat database of Windows 10 and Windows 11. The application resources usage data is automatically collected by Windows operating systems and includes the following information: Record ID, Timestamp, Application, User, Cycle Time (Foreground/Background), Face Time, Context Switches (Foreground/Background), Bytes Read/Written (Foreground/Background), Read/Write Operations Count (Foreground/Background).

AtNow is a command-line utility that schedules programs and commands to run in the near future.

BatteryHistoryView extracts and displays the history information of the laptop battery stored in the SRUDB.dat database. The battery history information is automatically collected by Windows operating systems and includes the following information: Timestamp, Cycle Count, Designed Capacity, Full Charged Capacity, Charge Level, Charge Percent, Active AC Time, CS AC Time, Active DC Time, CS DC Time, Active Discharge Time, CS Discharge Time, Active Energy, CS Energy.

BatteryInfoView is a small utility for laptops and netbook computers that displays the current status and information about your battery. The displayed battery information includes the battery name, manufacture name, serial number, manufacture date, power state (charging/discharging), current battery capacity, full charged capacity, voltage, charge/discharge rate, and more.

BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version).

BluetoothCL is a small console application that dumps all current detected bluetooth devices into the standard output. For each Bluetooth device, the following information is displayed: MAC Address, Name, Major Device Type, Minor Device Type, and optionally the company name of the device.

BluetoothLogView is a small utility that monitors the activity of Bluetooth devices around you, and displays a log of Bluetooth devices on the main window. Every time that a new Bluetooth device arrives to your area and when the device leaves your area, a new log line is added with the following information: Device Name, Device Address, Event Time, Event Type ('Device Arrival' or 'Device Left'), Device Type, and the company that created the device.

BluetoothView is a small utility that runs in the background, and monitor the activity of Bluetooth devices around you. For each detected Bluetooth device, it displays the following information: Device Name, Bluetooth Address, Major Device Type, Minor Device Type, First Detection Time, Last Detection Time, and more. BluetoothView can also notify you when a new Bluetooth device is detected, by displaying a balloon in your taskbar or by playing a small beep sound.

BrowserAddonsView is a simple tool that displays the details of all Web browser addons/plugins installed in your system. BrowserAddonsView can scan and detect the addons of most popular Web browsers: Chrome, Firefox, and Internet Explorer.

BrowserDownloadsView is a tool for Windows that displays the details of downloaded files of Chrome and Firefox Web browsers. For every download, the following information is displayed: Filename, Download URL, Web Page URL, Start Time, End Time, Download Duration, Download Size, Web Browser, and more.

BrowsingHistoryView is a utility that reads the history data of 4 different Web browsers (Internet Explorer, Mozilla Firefox, Google Chrome, and Safari) and displays the browsing history of all these Web browsers in one table. The browsing history table includes the following information: Visited URL, Title, Visit Time, Visit Count, Web browser and User Profile.

BulkFileChanger is a small utility that allows you to create files list from multiple folders, and then make some action on them - Modify their created/modified/accessed time, change their file attribute (Read Only, Hidden, System), run an executable with these files as parameter, and copy/cut paste into Explorer.

ChromeCacheView is a small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache. For each cache file, the following information is displayed: URL, Content type, File size, Last accessed time, Expiration time, Server name, Server response, and more. You can easily select one or more items from the cache list, and then extract the files to another folder, or copy the URLs list to the clipboard.

ChromeCookiesView is an alternative to the standard internal cookies viewer of Google Chrome Web browser. It displays the list of all cookies stored by Google Chrome Web browser, and allows you to easily delete unwanted cookies.

ChromeHistoryView is a small utility that reads the history data file of Google Chrome Web browser, and displays the list of all visited Web pages in the last days.

CleanAfterMe allows you to easily clean files and Registry entries that are automatically created by the Windows operating system during your regular computer work. With CleanAfterMe, you can clean the cookies/history/cache/passwords of Internet Explorer, the 'Recent' folder, the Registry entries that record the last opened files, the temporary folder of Windows, the event logs, the Recycle Bin, and more.

Clipboardic is a small utility that listen to the clipboard activity, and each time that you copy something into the clipboard, it automatically save the copied data into Windows clipboard file (.clp). Later, when you need the copied data again, you can simply select the right clipboard file, and Clipboardic will automatically insert it into the clipboard. Clipboardic also allows you to easily share the clipboard data between multiple computers on your local network.

ControlMyMonitor allows you view and modify the settings of your monitor (Also known as 'VCP Features'), like brightness, contrast, sharpness, red/green/blue color balance, and more... You can modify the monitor settings from the GUI and from command-line.

CountryTraceRoute is a Traceroute utility, similar to the tracert tool of Windows, but with graphical user interface, and it's also much faster than tracert of Windows. CountryTraceRoute also displays the country of the owner of every IP address found in the Traceroute.

CSVFileView is a simple CSV file viewer/converter utility that allows you to easily view the content of CSV or tab-delimited file created by NirSoft utilities or by any other software, in a simple table viewer.

CurrPorts displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it. In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file.

CurrProcess utility displays the list of all processes currently running on your system. For each process, you can view the list of all modules (DLL files) that the process loads into memory. For all processes and modules, additional useful information is also displayed: product name, version, company name, description of the file, the size of the file, and more. In addition, CurrProcess allows you to do the following actions: Kill a process, Dump memory of process into a text file, Create HTML report containing information about a process with the list of all modules that it loads into memory, Save the list of all running processes into text or HTML file, and more.

CustomExplorerToolbar is small utility for Windows 7 only, which allows you to easily customize the toolbar of Windows Explorer, and add buttons that were existed in previous versions of Windows, like Copy, Cut, Paste, Select All, and more.

Add new menu items and toolbar buttons to Internet Explorer.

DeviceIOView allows you to watch the data transfer between a software or service and a device driver (DeviceIoControl calls). For each call to a device driver, the following information is displayed: Handle, Control Code, number of input bytes, number of output bytes, the name of the device handle, and all the input/output bytes, displayed as Hex dump.

DevManView is an alternative to the standard Device Manager of Windows, which displays all devices and their properties in flat table, instead of tree viewer. In addition to displaying the devices of your local computer, DevManView also allows you view the devices list of another computer on your network, as long as you have administrator access rights to this computer.

DiskCountersView displays the system counters of each disk drive in your system, including the total number of read/write operations and the total number of read/write bytes. It also displays general drive information, like disk name, partition number, partition location, and so on.

DiskSmartView is a small utility that retrieves the S.M.A.R.T information (S.M.A.R.T = Self-Monitoring, Analysis, and Reporting Technology) from IDE/SATA disks. This information includes the disk model/firmware/serial number, cylinders/heads, power-on hours (POH), internal temperature, disk errors rate, and more.

This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL files. You can easily copy the memory address of the desired function, paste it into your debugger, and set a breakpoint for this memory address. When this function is called, the debugger will stop in the beginning of this function.

This utility is a GUI alternative to the NSLookup tool that comes with Windows operating system. It allows you to easily retrieve the DNS records (MX, NS, A, SOA) of the specified domains. You can use the default DNS server of your Internet connection, or use any other DNS server that you specify. After retrieving the DNS records for the desired domains, you can save them into text/xml/html/csv file.

DNSLookupView is a DNS tracing tool that allows you to view the details of every DNS query sent through the DNS Client service of Windows. For every DNS query, the following information is displayed: Host Name, Query Type (A, AAAA, and so on), Query Status (Error or succeeded), Query Result, Query Timestamp, ID and name of the process that requested the DNS lookup.

DNSQuerySniffer is a network sniffer utility that shows the DNS queries sent on your system. For every DNS query, the following information is displayed: Host Name, Port Number, Query ID, Request Type (A, AAAA, NS, MX, and so on), Request Time, Response Time, Duration, Response Code, Number of records, and the content of the returned DNS records.

DomainHostingView collects extensive information about a domain by using a series of DNS and WHOIS queries, and generates HTML report that can be displayed in any Web browser. The information displayed by the report of DomainHostingView includes: the hosting company or data center that hosts the Web server, mail server, and domain name server (DNS) of the specified domain, the created/changed/expire date of the domain, domain owner, domain registrar that registered the domain, list of all DNS records, and more.

DotNetResourcesExtract is a small utility that scan dll/exe files of .NET applications, and extract all .NET embedded resources (Bitmaps, Gifs, HTML files, and so on) stored in them into the folder that you specify. c# source code is available.

DownTester allows you to easily test your Internet download speed in multiple locations around the world. It automatically test the download speed of the URLs that you choose, one after another.

DriveLetterView is a simple utility that allows you to view the list of all drive letter assignments in your system, including local drives, remote network drives, CD/DVD drives, and USB drives - even if they are not currently plugged.

DriverView utility displays the list of all device drivers currently loaded on your system. For each driver in the list, additional useful information is displayed: load address of the driver, description, version, product name, company that created the driver, and more.

DumpEDID is a small console application that extract the EDID ("Extended display identification data") records from your computer, analyze it, and dump it into the console window. EDID record provide essential information about your monitor: manufacture week/year, monitor manufacturer, monitor model, supported display modes, and so on... You can also get the EDID records of a remote computer, if you login to this computer with administrator rights. (DumpEDID is the console version of MonitorInfoView utility)

EdgeCookiesView is a tool that displays the cookies stored by newer versions of Microsoft Edge Web browser. It also allows you to select one or more cookies and then export them to tab-delimited, csv file, html file, or to a file in cookies.txt format. You can read the cookies from the current running system or from the WebCacheV01.dat database on external hard drive.

ESEDatabaseView is a simple utility that reads and displays the data stored inside Extensible Storage Engine (ESE) database (Also known as 'Jet Blue' or .edb file).

EventLogChannelsView is a simple tool that shows the list of all event log channels on your system, including the channel name, event log filename, enabled/disabled status, current number of events in the channel, and more.

EventLogSourcesView is a simple tool that displays the list of all event log sources installed on your system. For every event log source, the following information is displayed: Event Source Name, Event Type, DLL/EXE Files containing the event message strings, Registry Modified Time, and version information taken from the DLL/EXE file (Product Name, Company, File Description, File Version).

ExecutedProgramsList is a simple tool that displays a list of programs and batch files that you previously executed on your system. For every program, ExecutedProgramsList displays the .exe file, the created/modified time of the .exe file, and the current version information of the program (product name, product version, company name) if it's available.

The ExeInfo utility shows general information about executable files (*.exe), dynamic-link libraries (*.dll), ocx files, and drivers files.

ExifDataView is a small utility that reads and displays the Exif data stored inside .jpg image files generated by digital cameras. The EXIF data includes the name of the company created the camera, camera model, the date/time that the photograph was taken, Exposure Time, ISO Speed, GPS information (for digital cameras with GPS), and more.

Explorestart is a very simple utility that simply restart Explorer and Internet Explorer. When you run this tool, all instances of Explorer (explorer.exe) and Internet Explorer (iexplore.exe) are terminated instantly, and a new instance of Explorer is created after a few seconds.

FastResolver is a small utility that resolves multiple host names into IP addresses and vice versa. You can simply type the list of IP addresses or host name that you want to resolve, or alternatively, you can specify IP addresses range that you want to scan. For local network, FastResolver also allows you to get the MAC address of all IP addresses that you scan. FastResolver is a multithreaded application, so it can resolve dozens of addresses within a few seconds.

FavoritesView displays the list of all your Favorties (of Internet Explorer browser) and bookmarks (of Netscape/Mozilla browsers) in a single page. Each line in the list specifies the title of the item, the URL address, the created/modified date of the bookmark item, and the folder name. You select one or more of these bookmarks, and then copy them to the clipboard, delete them (Only for Internet Explorer Favorites), export them to tab-delimited text file, HTML file, or XML file. FavoritesView also allows you to locate duplicate URL addresses in your Favorites/Bookmarks or find specific item by specifying the URL or the title.

FBCacheView is a simple tool that scans the cache of your Web browser (Internet Explorer, Firefox, or Chrome), and lists all images displayed in Facebook pages that you previously visited, including profile pictures, images uploaded to Facebook, and images taken from other Web sites.

FileAccessErrorView is a diagnostic tool that displays information about errors occur while programs running on your system try to open/read/write/delete a file. FileAccessErrorView displays the filename that the application tried to open/read/write/delete, the process id/name of the application, the error code (NTSTATUS code), the description of the error code, the number of times that this error occurred, and the timestamp of this error.

FileActivityWatch is a tool that displays information about every read/write/delete operation of files occurs on your system. For every file, FileActivityWatch displays the number of read/write bytes, number of read/write/delete operations, first and last read/write timestamp, and the name/ID of the process responsible for the file operation.

FileTypesMan is an alternative to the 'File Types' tab in the 'Folder Options' of Windows. It displays the list of all file extensions and types registered on your computer. For each file type, the following information is displayed: Type Name, Description, MIME Type, Perceived Type, Flags, Browser Flags, and more. FileTypesMan also allows you to easily edit the properties and flags of each file type, as well as it allows you to add, edit, and remove actions in a file type.

This utility displays the list of the latest files that you downloaded with Firefox.

FirmwareTablesView is a simple tool for Windows that displays a list of firmware tables (ACPI, SMBIOS) stored on your system. You can view the content of these tables in Hex-dump format and export them to a binary file.

FlashCookiesView is a small utility that displays the list of cookie files created by Flash component (Local Shared Object) in your Web browser. For each cookie file, the lower pane of FlashCookiesView displays the content of the file in readable format or as Hex dump.

FolderChangesView is a simple tool that monitors the folder or disk drive that you choose and lists every filename that is being modified, created, or deleted while the folder is being monitored. You can use FolderChangesView with any local disk drive or with a remote network share, as long as you have read permission to the selected folder.

The FoldersReport utility scans a drive or a base folder that you select, and displays essential information for each folder that it finds: The size of all files inside the folder, The real files size on the disk, number of files inside the folder, number of hidden files, number of compressed files, and number of subfolders. You can use this utility to easily find out which folders use the most space in your drive. You can scan the folders of your local drives, CD-ROM drives, and network resources on a remote computer.

FolderTimeUpdate is a simple tool for Windows that scans all files and folders under the base folder you choose, and updates the 'Modified Time' of every folder according the latest modified time of the files stored in it.

FreeSpaceLogView is a tool for Windows 10 and Windows 11 that displays a log of free disk space on your system. This tool only works for NTFS formatted disks. For every log item, the following information is displayed: Log Time, Volume Name, Volume Guid, Lowest Free Space, Highest Free Space, Is Boot Volume (Yes/No), Volume Size (Windows 11 only), Lowest Free Space Percent (Windows 11 only), Highest Free Space Percent (Windows 11 only).

FullEventLogView is a simple tool displays in a table the details of all events from the event logs of Windows, including the event description. It allows you to view the events of your local computer, events of a remote computer on your network, and events stored in .evtx files.

GACView is an alternative to the standard .NET assembly viewer on Windows Explorer. In addition to the standard columns, GACView displays additional information for each assembly, like modified date, file size, full path of the assembly file, file version, and so on. GACView also allows you to delete an assembly the cannot be uninstalled in the regular way.

GDIView is a unique tool that displays the list of GDI handles (brushes, pens, fonts, bitmaps, and others) allocated by every process. It displays the total count for each type of GDI handle, as well as detailed information about each handle. This tool can be useful for developers that need to trace GDI resources leak in their software.

GetNir is a command-line tool for Windows that receives tab-delimited or comma-delimited data from other NirSoft tools through Standard input (stdin) , finds and extracts the desired values according to the specified filter expression and column names, and then sends these values to the Standard output (stdout).

GoogRank is a simple utility that retrieves and displays the Google's PageRank of a Web page.

GoogRankCmd is a simple command-line utility that retrieves and displays the Google's PageRank of a Web page ,without using Google Toolbar or any other browser plugin.

GUIPropView displays extensive information about all windows currently opened on your system. The upper pane of GUIPropView displays all top level windows, and when you select a window in the upper pane, the lower pane displays the list of all child windows of the selected top level window.

HandleCountersView is a simple tool that shows the current number of handles (File, Directory, Token, Job, Thread, and so on...) opened by every process running on your system and the change in number of handles since the last time that you reset the counters.

HashMyFiles is small utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in your system. You can easily copy the MD5/SHA1 hashes list into the clipboard, or save them into text/html/xml file. HashMyFiles can also be launched from the context menu of Windows Explorer, and display the MD5/SHA1 hashes of the selected file or folder.

HeapMemView is a small utility that allows you to view the content of all memory blocks allocated in the heap of the process the you select. This tool can be useful for developers that need to trace memory leaks in their software.

HostedNetworkStarter is a simple tool for Windows 7 and later that allows you to easily create a wifi hotspot with your wireless network adapter, using the Wifi hosted network feature of Windows operating system. With the wifi hotspot created by this tool, you can allow any device with wifi support to access the network and the Internet connection available in your computer.

HotKeysList is a simple tool for Windows that displays the list of hot keys that are currently registered on your system.

HTMLAsText utility converts HTML documents to simple text files, by removing all HTML tags and formatting the text according to your preferences.

HtmlDocEdit is a simple HTML designer/editor based on the Internet Explorer browser, that allows you to easily edit HTML files without any knowledge in HTML. With HtmlDocEdit you can change the font/color of selected text, add images, add links, add ordered and unordered lists, and more...

HTTPNetworkSniffer is a packet sniffer tool that captures all HTTP requests/responses sent between the Web browser and the Web server and displays them in a simple table. For every HTTP request, the following information is displayed: Host Name, HTTP method (GET, POST, HEAD), URL Path, User Agent, Response Code, Response String, Content Type, Referer, Content Encoding, Transfer Encoding, Server Name, Content Length, Cookie String, and more.

Extract icons and cursors from EXE, DLL, CPL, and OCX files and save them as ICO or CUR files.

This utility allows you to instantly open Outlook Express with the desired identity, without requiring you to switch the identity through the menu of Outlook Express.

IECacheView is a small utility that reads the cache folder of Internet Explorer, and displays the list of all files currently stored in the cache. For each cache file, the following information is displayed: Filename, Content Type, URL, Last Accessed Time, Last Modified Time, Expiration Time, Number Of Hits, File Size, Folder Name, and full path of the cache filename. You can easily save the cache information into text/html/xml file, or copy the cache table to the clipboard and then paste it to another application, like Excel or OpenOffice Spreadsheet.

Displays the installed Internet Explorer components on your computer.

This utility displays the details of all cookies that Internet Explorer stores on your computer. In addition, it allows you to change the content of the cookies, delete unwanted cookies files, save the cookies into a readable text file, find cookies by specifying the domain name, view the cookies of other users and in other computers, and more...

This utility reads all information from the history file on your computer, and displays the list of all URLs that you have visited in the last few days. It also allows you to select one or more URL addresses, and then remove them from the history file or save them into text, HTML or XML file. In addition, you are allowed to view the visited URL list of other user profiles on your computer, and even access the visited URL list on a remote computer, as long as you have permission to access the history folder.

ImageCacheViewer is a simple tool that scans the cache of your Web browser (Internet Explorer, Firefox, or Chrome), and lists the images displayed in the Web sites that you recently visited. For every cached image file, the following information is displayed: URL of the image, Web browser that was used to visit the page, image type, date/time of the image, browsing time, and file size.

InjectedDLL is a small utility that displays the list of DLLs that are automatically injected on every process in your system.

Each time that you copy something into the clipboard for pasting it into another application, the copied data is saved into multiple formats. The main clipboard application of Windows only display the basic clipboard formats, like text and bitmaps, but doesn't display the list of all formats that are stored in the clipboard. InsideClipboard is a small utility that displays the binary content of all formats that are currently stored in the clipboard, and allow you to save the content of specific format into a binary file.

InstalledAppView is a tool for Windows 10 that displays the details of Windows 10 apps installed on your system. For every Windows app, the following information is displayed: App Name, App Version, Registry Name, Registry Modified Time, Install Folder, Install Folder Owner, Uninstall Command, and more.

InstalledCodec is a small utility displays the list of all Codec drivers and DirectShow filters currently installed on your system. For each component the following information is displayed: Display Name, Type, Disabled Status, Installed/Modified Time, Description, Company Name, Filename, and more.

InstalledDriversList is a simple tool for Windows that lists all device drivers that are currently installed on your system. For every device driver, the following information is displayed: Driver Name, Display Name, Description, Startup Type, Driver type, Driver Group, Filename, File Size, Modified/Created Time of the driver file, and version information of the driver file.

InstalledPackagesView is a tool that displays the list of all software packages installed on your system with Windows Installer, and lists the files, Registry keys, and .NET Assemblies associated with them. For every installed software, the following information is displayed: Display Name, Display Version, Install Date, Registry Time, Estimated Size, Install Location, Install Source, MSI Filename (In C:\Windows\Installer), and more.

IPInfoOffline Allows you to view information about IP addresses, without connecting any external server. It uses a compressed IP addresses database that is stored inside the exe file. For each IP address, the following information is displayed: IP block range, Organization (RIPE, ARIN, APNIC, LACNIC or AFRINIC), Assigned Date, Country Name, and Country Code. After retrieving the information about the desired IP addresses, You can copy the information to the clipboard, or save it into text/html/xml/csv file.

IPNeighborsView is a tool that displays the IP neighbor table of your local computer. For every IP neighbor entry, the following information is displayed: IP Address, MAC Address, MAC Address Company, State, State Time, Local Adapter Name, Local Connection Name.

IPNetInfo is a small utility that allows you to easily find all available information about an IP address: The owner of the IP address, the country/state name, IP addresses range, contact information (address, phone, fax, and email), and more.

IPPathTableView is a tool that displays the IP path table of your local computer. For every IP path entry, the following information is displayed: Source, Destination, Next Hop, MTU, Reachaable (Yes/No), Adapter Name, Connection Name, Link Transmit Speed, Link Receive Speed.

This utility allows you to easily create animation from image files (GIFs and JPGs) on your local drive. The animation is achieved by creating a simple HTML page with JavaScript animation, and running it on your default browser.

JRView is a small utility that displays the list of all Java Runtime Environments and Java Development Kits installed on your system, and allows you to run a Java application (.class or .jar file) on the desired Java environment.

JumpListsView is a simple tool that displays the information stored by the 'Jump Lists' feature of Windows 7 and Windows 8. For every record found in the Jump Lists, the following information is displayed: The filename that the user opened, the date/time of the file opening event, the ID of the application that was used to open the file, the size/time/attributes of the file on the time that the file was opened, and more.

KeyboardStateView is a simple tool that displays the current state and virtual key code of every key you press. It also allows you to view the current state of all keyboard keys. For every key, the following information is displayed: Key Name (VK_XXXX ), Description, Key Code (Decimal), Key Code (Hexadecimal), Key Pressed Status, Key Toggled Status (Useful for Num Lock, Caps Lock), and last time that the key was pressed.

LastActivityView is a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer. The activity displayed by LastActivityView includes: Running .exe file, Opening open/save dialog-box, Opening file/folder from Explorer or other software, software installation, system shutdown/start, application or system crash, network connection/disconnection and more.

LiveContactsView is a small utility that allows you to view the details of all contacts in your Windows Live Messenger.

LiveTcpUdpWatch is a tool that displays live information about all TCP and UDP activity on your system. Every line in the main table of LiveTcpUdpWatch displays the protocol (TCP/UDP/IPv4/IPv6), local/remote IP address, local/remote port, number of sent/received bytes, number of sent/received packets, connect/disconnect time (For TCP only), and the process (ID and path) responsible for this activity.

LoadedDllsView is a simple tool that scans all running processes on your system and displays the list of all DLL files loaded by these processes and the number of processes that load each DLL in the list.

MACAddressView is a MAC address lookup tool that allows you to easily find the company details (company name, address, and country) according to the MAC address of a product.

ManageWirelessNetworks is an alternative tool to the standard 'Manage Wireless Networks' of Windows (or 'Manage Known Networks' on Windows 10). It displays extensive information about every wireless profile on your system, even if the network adapter is not active. For every wireless profile, the following information is displayed: Profile Name, SSID, Connection Type, Connection Mode, Authentication, Encryption, Key Type, Auto Switch (Yes/No), Non Broadcast (Yes/No), Profile Position, Created Time, Modified Time, Wireless Key, and more.

The MetarWeather utility decodes METAR weather reports from around the world, and displays them in a simple weather report table. You can save the weather report into a text or HTML files. MetarWeather can decode METAR reports from a text file, or download the latest reports directly from the Internet.

This utility displays the list of all MIME types defined in your system. For each MIME type, information about the associated file extension and installed plugin is also displayed.

MMCSnapInsView is a simple tool for Windows that displays the details of all MMC snap-ins installed on your system, including name, description, CLSID, dll file, product name, company name, file version, and more.

MobileFileSearch is a tool for Windows that allows you to search files inside a mobile device (Smartphone or Tablet) plugged to the USB port on your computer, with Media Transfer Protocol (MTP).

MonitorInfoView is a small utility that displays essential information about your monitor: manufacture week/year, monitor manufacturer, monitor model, supported display modes, and more... The information is extracted from the EDID ("Extended display identification data") records stored on your computer. You can also view the monitor information of multiple computers on your network, if you login to these computers with administrator rights.

Each time that you start using a new application, Windows operating system automatically extract the application name from the version resource of the exe file, and stores it for using it later, in Registry key known as the 'MuiCache'.This utility allows you to easily view and edit the list of all MuiCache items on your system. You can edit the name of the application, or alternatively, you can delete unwanted MUICache items.

MultiMonitorTool is a small tool that allows you to do some actions related to working with multiple monitors. With MultiMonitorTool, you can disable/enable monitors, set the primary monitor, save and load the configuration of all monitors, and move windows from one monitor to another.

MyEventViewer is a simple alternative to the standard event viewer of Windows. As oppose to Windows event viewer, MyEventViewer allows you to watch multiple event logs in one list, as well as the event description and data are displayed in the main window, instead of opening a new one. Also, with MyEventViewer you can easily select multiple event items and then save them to HTML/Text/XML file, or copy them to the clipboard (Ctrl+C) and then paste them into Excel.

MyLastSearch utility scans the cache and history files of your Web browser, and locate all search queries that you made with the most popular search engines (Google, Yahoo and MSN). The search queries that you made are displayed in a table with the following columns: Search Text, Search Engine, Search Time, Web Browser, and the search URL. You can select one or more search queries and then copy them to the clipboard or save them into text/html/xml file.

The MyPopupKiller utility displays the list of all opened windows of your Web browser, and closes unwanted popup and advertising windows.

MyUninstaller is an alternative utility to the standard Add/Remove applet of Windows operating system. It displays the list of all installed application, and allows you to uninstall an application, delete an uninstall entry, and save the list of all installed applications into a text file or HTML file. MyUninstaller also provides additional information for most installed applications that the standard Add/Remove applet doesn't display: product name, company, version, uninstall string, installation folder and more.

MZCacheView is a small utility that reads the cache folder of Firefox/Mozilla/Netscape Web browsers, and displays the list of all files currently stored in the cache. For each cache file, the following information is displayed: URL, Content type, File size, Last modified time, Last fetched time, Expiration time, Fetch count, Server name, and more. You can easily select one or more items from the cache list, and then extract the files to another folder, or copy the URLs list to the clipboard.

MZCookiesView is an alternative to the standard 'Cookie Manager' provided by Netscape and Mozilla browsers. It displays the details of all cookies stored inside the cookies file (cookies.txt) in one table, and allows you to save the cookies list into text, HTML or XML file, delete unwanted cookies, and backup/restore the cookies file.

MZHistoryView is a small utility that reads the history data file (history.dat) of Firefox/Mozilla/Netscape Web browsers, and displays the list of all visited Web pages in the last days. For each visited Web page, the following information is displayed: URL, First visit date, Last visit date, Visit counter, Referrer, Title, and Host name. You can also easily export the history data to text/HTML/Xml file.

NetBScanner is a network scanner tool that scans all computers in the IP addresses range you choose, using NetBIOS protocol. For every computer located by this NetBIOS scanner, the following information is displayed: IP Address, Computer Name, Workgroup or Domain, MAC Address, and the company that manufactured the network adapter (determined according to the MAC address). NetBScanner also shows whether a computer is a Master Browser.

NetConnectChoose is a simple tool that allows you to easily choose the default Internet connection that will be used by all Internet applications, when you have more than a single Internet connection on the same time. It also displays extensive information about every active network/Internet connection, including network adapter name, MAC Address, Name Servers, MTU, Interface Speed, current incoming/outgoing data speed, number of received/sent packets, received/sent bytes, and more

NetResView is a small utility that displays the list of all network resources (computers, disk shares, and printer shares) on your LAN. As opposed to "My Network Places" module of Windows, NetResView display all network resources from all domains/workgroups in one screen, and including admin/hidden shares.

NetRouteView is a GUI alternative to the standard route utility (Route.exe) of Windows operating system. It displays the list of all routes on your current network, including the destination, mask, gateway, interface IP address, metric value, type, protocol, age (in seconds), interface name, and the MAC address.

NetworkConnectLog is a simple utility that repeatedly scans your local area network (Using ARP and Netbios protocols) and add a new log line every time that a new computer or device connects to your network, and when a computer or device disconnects from your network.

Displays system counters for every network interface on your system. The system counters include the number of incoming/outgoing bytes, number of incoming/outgoing packets, number of broadcast packets, and more. You can also initialize all counters to zero at any time in order to watch the network counters for specific event. NetworkCountersWatch also calculates and displays the current download speed and upload speed on your network interface.

NetworkInterfacesView is a simple tool that displays the list of all network adapters/interfaces installed on your system. It displays network interfaces that are currently active, as well as network interfaces that have been installed previously, and now they are not connected (like USB wireless network adapters). For every network interface found on your system, the following information is displayed (if it's stored in the Registry): Device Name, Connection Name, IP Address, Subnet Mask, Default Gateway, DHCP Server, Status, MAC Address and more.

NetworkLatencyView is a simple tool for Windows that listens to the TCP connections on your system and calculates the network latency (in milliseconds) for every new TCP connection detected on your system. For every IP address, NetworkLatencyView displays up to 10 network latency values, and their average.

NetworkOpenedFiles is a simple tool for Windows that displays the list of all files that are currently opened by other computers on your network.

NetworkTrafficView is a network monitoring tool that captures the packets pass through your network adapter, and displays general statistics about your network traffic. The packets statistics is grouped by the Ethernet Type, IP Protocol, Source/Destination Addresses, and Source/Destination ports. For every statistics line, the following information is displayed: Ethernet Type (IPv4, IPv6, ARP), IP Protocol (TCP, UDP, ICMP), Source Address, Destination Address, Source Port, Destination Port, Service Name (http, ftp, and so on), Packets Count, Total Packets Size, Total Data Size, Data Speed, Maximum Data Speed, Average Packet Size, First/Last Packet Time, Duration, and process ID/Name (For TCP connections).

NetworkUsageView extracts and displays the network usage information stored in the SRUDB.dat database of Windows 8 and Windows 10. The network usage data is collected every hour by Windows operating systems and includes the following information: The name and description of the service or application, the name and SID of the user, the network adapter, and the total number of bytes sent and received by the specified service/application.

NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface. By running NirCmd with simple command-line option, you can write and delete values and keys in the Registry, write values into INI file, dial to your internet account or connect to a VPN network, restart windows or shut down the computer, create shortcut to a file, change the created/modified date of a file, change your display settings, and more...

Every time that you type an email address or name in the message window of MS-Outlook, it automatically offer you a list of users and email address that you can choose. In some circumstances, you may need to fix or modify the values appeared in the AutoComplete list, or you may want to remove unwanted email addresses and/or to add new email addresses. MS-Outlook doesn't provide any ability to edit this AutoComplete list, so this is where NK2Edit software can help you.

Each time that you send a new message in Outlook, the emails that you type in To/Cc fields, are automatically inserted into the AutoComplete list, so in the next time that you type an email address, Outlook automatically completes the right email address for you. The AutoComplete file of Outlook is stored under [Your Profile]\Application Data\Microsoft\Outlook , and it always saved as the profile name of Outlook with .NK2 extension. This utility reads the AutoComplete file of Outlook (with .NK2 extension), displays all email records stored in it, and allows you to easily export these records into text/html/xml file.

NTFSLinksView shows you to list of all symbolic links and junctions in the specified folder, and their target paths. It also allows you to save the symbolic links/junctions list into text/html/xml/csv file.

OfficeIns is a small utility that displays the details of all installed Microsoft Office add-ins on your computer, and allows you to disable/enable them.

OfflineRegistryFinder is a tool that allows you to scan Registry files from external drive and find the desired Registry keys/values/data according to the search criteria you define. After OfflineRegistryFinder displays the search result, you can easily select one or more items and then export them into a .reg file that can be used to import in the RegEdit tool of Windows. OfflineRegistryFinder can also be used for Registry scan of your running operating system.

OfflineRegistryView is a simple tool that allows you to read offline Registry files from external drive and view the desired Registry key in .reg file format.

OpenedFilesView displays the list of all opened files on your system. For each opened file, additional information is displayed: handle value, read/write/delete access, file position, the process that opened the file, and more... Optionally, you can also close one or more opened files, or close the process that opened these files.

OpenSaveFilesView is a simple tool that displays the list of files that you previously opened with the standard open/save dialog-box of Windows. For every file in the list, the following information is displayed: Filename, Extension, Order (The order that the files were opened for every file extension), Open Time (Available only for the last opened file of every file type), File Modified/Created Time, File Size, and File Attributes.

OpenWithView is a small utility that displays the list of all available applications in the 'Open With' dialog-box of Windows, and allows you to easily disable/enable the applications in the list. When application is disabled, it won't be displayed in the 'Other Programs' section of the 'Open With' dialog-box. This utility can be useful if your 'Open With' window displays too much applications, and you want to remove the applications that you don't use frequently.

OutlookAddressBookView is a simple utility that displays the details of all recipients stored in the address books of Microsoft Outlook. For every recipient entry, the following information is displayed: Email Address, Display Name, Address Type (MS-Exchange or SMTP), Street Address, Phone Number, Created Time, Modified Time (Works only with address books of Exchange server), and more...

OutlookAttachView scans all messages stored in your Outlook, and displays the list of all attached files that it finds. You can easily select one or more attachments and save all of them into the desired folder, as well as you can delete unwanted large attachments that take too much disk space in your mailbox. You can also save the list of attachments into xml/html/text/csv file.

OutlookStatView scans your Outlook mailbox, and display a general statistics about the users that you communicate via emails.

This small utility allows you to scan a TCP/IP network and get the list of all pcANYWHERE hosts within that network.

PingInfoView is a small utility that allows you to easily ping multiple host names and IP addresses, and watch the result in one table. It automatically ping to all hosts every number of seconds that you specify, and displays the number of succeed and failed pings, as well as the average ping time. You can also save the ping result into text/html/xml file, or copy it to the clipboard.

PreviousFilesRecovery is a simple tool that allows you to scan the shadow copies of your local hard drive and find deleted files as well as older versions of existing files. If the file you need is found in the shadow copies of Windows, you can easily recover it by copying it into existing folder on your drive.

ProcessActivityView creates a summary of all files and folders that the selected process tries to access. For each file that the process access, the following information is displayed: Number of times that the file was opened and closed, number of read/write calls, total number of read/write bytes, the dll that made the last open-file call, and more...

ProcessTCPSummary is a simple tool that displays a summary of all process that have TCP connections or listening UDP ports. For every process, this tool displays the total number of TCP connections, number of TCP connections for each status (Established, Listening, Syn-Sent, Syn-Received...), number of IPv4 TCP connections, number of IPv6 TCP connections, common port numbers, and more.

ProcessThreadsView is a small utility that displays extensive information about all threads of the process that you choose. The threads information includes the ThreadID, Context Switches Count, Priority, Created Time, User/Kernel Time, Number of Windows, Window Title, Start Address, and more.

ProduKey is a small utility that displays the ProductID and the CD-Key of MS-Office, Windows, and SQL Server installed on your computer. You can view this information for your current running operating system, or for another operating system/computer - by using command-line options.

PropertySystemView is a tool that allows you view and modify the properties of file from GUI and command-line, using the property system of Windows operating system. For example, you can change the 'Media Created' timestamp stored in .mp4 files (System.Media.DateEncoded) as well as other metadata stored in media files and office documents, like Title, Comments, Authors, Tags, Date Acquired, Last Saved Date, Content Created Date, Date Imported, Date Taken (EXIF of .jpg files), and more.

QuickSetDNS is a simple tool that allows you to easily change the DNS servers that are used for your Internet connection. You can set the desired DNS servers from the user interface, by choosing from a list of DNS servers that you defined, or from command-line, without displaying any user interface.

Each time that you open a file from Windows Explorer or from a standard open/save dialog-box, the name of the file that you opened is recorded by the operating system. Some of the names are saved into the 'Recent' folder. Other are saved into the Registry. This utility display the list of all recently opened files, and allows you to delete unwanted filename entries. You can also save the files list into text/html/xml file.

RegDllView is a small utility that displays the list of all registered dll/ocx/exe files (COM registration). For each registered file, you can view the last date/time that it was registered, and the list of all registration entries (CLSID/ProgID).

RegFileExport is a small console application that allows you to easily extract data from offline Registry file located on another disk drive.

RegFromApp monitors the Registry changes made by the application that you selected, and creates a standard RegEdit registration file (.reg) that contains all the Registry changes made by the application. You can use the generated .reg file to import these changes with RegEdit when it's needed.

RegistryChangesView is a tool for Windows that allows you to take a snapshot of Windows Registry and later compare it with another Registry snapshots, with the current Registry or with Registry files stored in a shadow copy created by Windows. When comparing 2 Registry snapshots, you can see the exact changes made in the Registry between the 2 snapshots, and optionally export the Registry changes into a standard .reg file of RegEdit.

RegScanner is a small utility that allows you to scan the Registry, find the desired Registry values that match to the specified search criteria, and display them in one list. After finding the Registry values, you can easily jump to the right value in RegEdit, simply by double-clicking the desired Registry item.

ResourcesExtract is a small utility that scans dll/ocx/exe files and extract all resources (bitmaps, icons, cursors, AVI movies, HTML files, and more...) stored in them into the folder that you specify. You can use ResourcesExtract in user interface mode, or alternatively, you can run ResourcesExtract in command-line mode without displaying any user interface.

RTMPDumpHelper is a small utility that can help you to easily download RTMP video/audio streams. By combining this utility and the proxy server of RTMPDump toolkit, you can simply open a Web page containing RTMP video stream in your favorite Web browser, and while watching the video, it'll be saved to your disk automatically as .flv or .mp4 file. RTMP is a streaming protocol used by Hulu, justin.tv, and by many live streaming Web sites.

RunAsDate is a small utility that allows you to run a program in the date and time that you specify. This utility doesn't change the current system date and time of your computer, but it only injects the date/time that you specify into the desired application. You can run multiple applications simultaneously, each application works with different date and time, while the real date/time of your system continues to run normally.

RunFromProcess is a command-line utility that allows you to run a program from another process that you choose. The program that you run will be executed as a child of the specified process and it'll run with the same user and security context of the specified parent process.

RuntimeClassesView is a tool that displays the list of Windows Runtime (WinRT) classes installed on your system. For every Runtime class, the following information is displayed: Class Name, Filename, Threading, Trust Level, Server, Activation Type, Registry Key, Bitness, Key Modified Time, CLSID, and file version information.

SafariCacheView is a simple utility for Windows that reads and parses the cache file of Safari Web browser (cache.db) and displays the list of all cached files in a simple table.

SafariHistoryView is a simple utility for Windows that reads and parses the history file of Safari Web browser (history.plist) and displays the browsing history in a simple table. Every browsing history line includes the following information: URL, Web Page Title, Last Visit Time, Visit Count, Redirected To URL, and Record Index.

This utility allows you to easily view the search filters installed on your system and the file extensions that are associated with them, as well as it allows you to easily add or remove file extensions for these filters. When you search the content of files with Windows search, it uses the right search IFilter plugin according to the file extension.

SearchMyFiles is an alternative to the standard "Search For Files And Folders" module of Windows. It allows you to easily search files in your system by wildcard, by last modified/created/last accessed time, by file attributes, by file content (text or binary search), and by the file size.

SecuritySoftView is a simple tool that displays the AntiVirus, AntiSpyware, and Firewall programs that are currently installed on your system and registered with the security center of Windows operating system.

This utilities allows you to automatically download live images from the Web for every xxx seconds/minutes and store the files on your local drive. After collecting a fair amount of images, you can easily create nice animation from the downloaded images. This utility is especially useful for live cams Web sites, weather radar images, and satellite images.

ServiWin utility displays the list of installed drivers and services on your system. For some of them, additional useful information is displayed: file description, version, product name, company that created the driver file, and more. In addition, ServiWin allows you to easily stop, start, restart, pause, and continue service or driver, change the startup type of service or driver (automatic, manual, disabled, boot or system), save the list of services and drivers to file, or view HTML report of installed services/drivers in your default browser.

ShadowCopyView is simple tool that lists the snapshots of your hard drive created by the 'Volume Shadow Copy' service of Windows. Every snapshot contains an older versions of your files and folders from the date that the snapshot was created, you can browse the older version of your files and folders, and optionally copy them into a folder on your disk.

Each time that you open a folder in Explorer, Windows automatically save the settings of this folder into the Registry. This utility displays the list of all folder settings saved by Windows. For each folder, the following information is displayed: The date/time that you opened it, the entry number, display mode (Details, Icons, Tiles, and so on...), the last position of the window, and the last size of the window.

The ShellExView utility displays the details of shell extensions installed on your computer, and allows you to easily disable and enable each shell extension.

ShellMenuNew is a small utility that displays the list of all menu items in the 'New' submenu of Windows Explorer. It allows you to easily disable unwanted menu items, so this 'New' submenu will display only the items that you need.

ShellMenuView is a small utility that display the list of static menu items that appeared in the context menu when you right-click a file/folder on Windows Explorer, and allows you to easily disable unwanted menu items.

ShortcutsMan displays the details about all shortcuts that you have on your desktop and under your start menu. Broken shortcuts (shortcuts that point to file that doesn't exist) are automatically painted with pink color. You select one or more shortcuts, and then delete them, resolve them or save the shortcut's details to HTML/Text/XML file.

SimpleCodeGenerator is a simple tool that allows you to quickly generate QR Code for scanning with App on your Smartphone. You can display the QR Code on the screen, copy it to the clipboard and then paste it to another program (as image), or save it image file.

SimpleProgramDebugger is a simple debugging tool for Windows that attaches to existing running program or starts a new program in debugging mode, and then displays all major debugging events occurs while the program is running, including Exception, Create Thread, Create Process, Exit Thread, Exit Process, Load DLL, Unload Dll, and Debug String.

SimpleWMIView is a simple tool for Windows that displays the result of WMI queries in a simple table, and allows you to easily export the data to text/csv/tab-delimited/html/xml file. With SimpleWMIView you can get extensive information about your system, like a list of running processes, services, drivers, user accounts, hardware, and so on.

SiteShoter is a small utility that allows you to save a screenshot of any Web page into a file. It automatically creates hidden window of Internet Explorer, loads the desired Web page, and than save the entire content of the Web page into an image file (.png, .jpg, .tiff, .bmp or .gif). You can use SiteShoter in user interface mode, or alternatively, you can run SiteShoter in command-line mode without displaying any user interface.

SkypeLogView reads the log files created by Skype application, and displays the details of incoming/outgoing calls, chat messages, and file transfers made by the specified Skype account. You can select one or more items from the logs list, and then copy them to the clipboard, or export them into text/html/csv/xml file.

SmartSniff allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode (for text-based protocols, like HTTP, SMTP, POP3 and FTP.) or as hex dump. (for non-text base protocols, like DNS)

This utility removes the reference to strong name signature from .NET exe and dll files. After removing the strong name reference, you can make any change you want in dll/exe file, without getting any exception or error message.

SocketSniff allows you to watch the Windows Sockets (WinSock) activity of the selected process.

SoundVolumeCommandLine (svcl.exe) is a console application that allows you to do many actions related to sound volume from command-line, including - set sound volume of devices and applications, mute/unmute devices and applications, increase/decrease volume of devices and applications, set the volume level of specific channel, set the default render/capture device, get the current sound volume level of specific device, and more.

SoundVolumeView is a simple tool that displays general information and current volume level for all active sound components on your system, and allows you to mute and unmute them instantly.

Windows operating system have dozens of special folders that are used for storing application settings and files, storing Internet files, saving temporary files, storing shortcuts to other files, and so on. This utility displays the list of all special folders in your system, and allows you to easily jump to the right folder simply by double-clicking the folder item. You can also save the list of all folder paths into text/html/xml file.

This utility, just as it sounds, allows your to crash the Windows operating system by initiating a Blue Screen of Death according to 5 parameters that you specify from command-line.

SysExporter utility allows you to grab the data stored in standard list-views, list boxes, and combo boxes from almost any application running on your system, and export it to text, HTML or XML file.

TableTextCompare is a small utility that allows you to easily compare 2 tab-delimited or comma-delimited (csv) files, and find out the difference between the 2 files. You can use this tool for comparing 2 different snapshots of data, created by other NirSoft utilities, like DriverView, ServiWin, USBDeview, CurrPorts, WirelessNetView, ShellExView, and many others.

TagsReport reads HTML file and displays statistical information about the tags the appears in it.

TaskSchedulerView is a simple tool that displays in a single table the list of all tasks from the Task Scheduler of Windows. It also allows you to easily disable/enable mutiple tasks at once. For every task, the following information is displayed: Task Name, Description, Status, Hidden (Yes/No), Last Run/Next Run Times, Task Folder, EXE filename or COM handler of the task, number of missed runs, and more.

TCPConnectProblemView is a tool that monitors the TCP connections on your system and displays an alert when a software tries to initiate a TCP connection and there is no response from the server. When a problem with a TCP connection is detected , TCPConnectProblemView adds a new entry with the following information: Process Name, Process ID, Detected On (date/time), Local Port, Local IP, Remote Port, Remote IP, Remote Host.

TcpLogView is a simple utility that monitors the opened TCP connections on your system, and adds a new log line every time that a TCP connection is opened or closed. For every log line, the following information is displayed: Even Time, Event Type (Open, Close, Listen), Local Address, Remote Address, Remote Host Name, Local Port, Remote Port, Process ID, Process Name, and the country information of the Remote IP.

TimeZonesView is a simple tool for Windows that displays all world time zones. For every time zone, the following information is displayed: name, description, current date/time in this time zone and date/time that daylight saving time begins and ends.

TurnedOnTimesView is a simple tool that analyses the event log of Windows operating system, and detects the time ranges that your computer was turned on. For every period of time that the computer was turned on, the following information is displayed: Startup Time, Shutdown Time, Duration, Shutdown Reason, Shutdown Type, Shutdown Process, and Shutdown Code.

TurnFlash is a small utility that allows you to eaily disable and enable the Macromedia Flash player component in Internet Explorer.

UninstallView is a tool that collects information about all programs installed on your system and displays the details of the installed programs in one table. You can use it to get installed programs information for your local system, for remote computer on your network, and for external hard-drive plugged to your computer. It also allows you to easily uninstall a software on your local computer and remote computer.

URLProtocolView is a simple utility that displays all URL protocols (for example: ftp:, telnet:, mailto:) that are currently installed on your system. For each URL protocol, the following information is displayed: The protocol name, the protocol description, the command-line that is executed when you type or click the URL, the product name, and the company name. This utility also allows you to easily enable/disable the URL protocols.

URLStringGrabber is a small utility that scans all opened windows of Internet Explorer and grab the URLs stored in them, including clickable links, images, script files, CSS files, RSS feeds, and flash (.swf) files.

USBDeview is a small utility that lists all USB devices that currently connected to your computer, as well as all USB devices that you previously used. For each USB device, exteneded information is displayed: Device name/description, device type, serial number (for mass storage devices), the date/time that device was added, VendorID, ProductID, and more... USBDeview also allows you to uninstall USB devices that you previously used, and disconnect USB devices that are currently connected to your computer. You can also use USBDeview on a remote computer, as long as you login to that computer with admin user.

USBDriveLog is a tool for Windows 10 that displays a log of all USB drives plugged to your computer. For every USB drive event, the following information is displayed: Device Model, Revision, Manufacturer, Serial Number, Plug Time, Unplug Time, Device ID, Device Capacity, and more.

USBLogView is a small utility that runs in the background and records the details of any USB device that is plugged or unplugged into your system. For every log line created by USBLogView, the following information is displayed: Event Type (Plug/Unplug), Event Time, Device Name, Description, Device Type, Drive Letter (For storage devices), Serial Number (Only for some types of devices), Vendor ID, Product ID, Vendor Name, Product Name, and more.

This utility decrypt and displays the list of all UserAssist entries stored under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist key in the Registry. The UserAssist key contains information about the exe files and links that you open frequently. you can save the list of UserAssist entries into text/html/xml/csv file, as well as you can delete unwanted items.

UserProfilesView displays the list of all user profiles that you currently have in your system. For each user profile, the following information is displayed: Domain\User Name, Profile Path, Last Load Time, Registry File Size, User SID, and more. You can save the profiles list into text/xml/html/csv file.

After watching a video in a Web site, you may want to save the video file into your local disk for playing it offline in the future. If the video file is stored in your browser's cache, this utility can help you to extract the video file from the cache and save it for watching it in the future.

Volumouse provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse.

This utility allows you to easily turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet to the remote computers.

WebBrowserBookmarksView is a simple tool that displays the details of all bookmarks stored in Chrome and Firefox Web browsers. For every bookmark, the following information is displayed: Title, URL, Folder Name, Folder Path, Position, Created Time, Modified Time (Only Firefox), ID, Guid, Web Browser, and Bookmarks File.

WebCacheImageInfo is a simple tool that searches for JPEG images with EXIF information stored inside the cache of your Web browser (Internet Explorer, Firefox, or Chrome), and then it displays the list of all images found in the cache with the interesting information stored in them, like the software that was used to create the image, the camera model that was used to photograph the image, and the date/time that the image was created.

WebCamImageSave is simple WebCam capture utility that allows you to easily capture a still image from your camera every number of seconds that you choose, and save it into image file (.jpg, .png, .bmp) on your disk.

WebCookiesSniffer is a packet sniffer tool that captures all Web site cookies sent between the Web browser and the Web server and displays them in a simple cookies table.

WebSiteSniffer is a packet sniffer tool that captures all Web site files downloaded by your Web browser while browsing the Internet, and stores them on your hard drive under the base folder that you choose.

This utility allows you to capture .flv (Flash Video) files and RTSP streams while the Web browser download and play them inside a Web page. After the entire video file is downloaded and played by the Web browser, the video file is saved in the folder that you selected, and you can play it offline later with any Video player. WebVideoCap can capture the video files of most popular video-sharing sites, including YouTube, Google Video, Yahoo Video, iFilm, Metacafe, Putfile, and more...

This utility displays the list of all applications that are loaded automatically when Windows starts up. For each application, the following information is displayed: Startup Type (Registry/Startup Folder), Command-Line String, Product Name, File Version, Company Name, Location in the Registry or file system, and more.It allows you to easily disable or delete unwanted programs that runs in your Windows startup.

WhatIsHang tries to detect the software or process that is currently hung, and displays some information that may allow you to sort out and understand what exactly is at the root of such unexpected behavior.

WhoisCL is a simple command-line utility that allows you to easily get information about a registered domain. It automatically connect to the right WHOIS server, according to the top-level domain name, and retrieve the WHOIS record of the domain. It supports both generic domains and country code domains.

WhoIsConnectedSniffer is a network discovery tool that listens to network packets on your network adapter using a capture driver (WinpCap or MS network monitor) and accumulates a list of computer and devices currently connected to your network. WhoIsConnectedSniffer uses various protocols to detect the computers connected to your network, including ARP, UDP, DHCP, mDNS, and BROWSER.

This utility allows you to easily get information about a registered domain. It automatically connect to the right WHOIS server, according to the top-level domain name, and retrieve the WHOIS record of the domain. It support both generic domains and country code domains.

WhosIP is a simple command-line utility that allows you to easily find all available information about an IP address: The owner of the IP address, the country/state name, IP addresses range, contact information (address, phone, fax, and email), and more.

WifiChannelMonitor captures wifi traffic on the channel you choose, using Microsoft Network Monitor capture driver in monitor mode, and displays extensive information about access points and the wifi clients connected to them. For every access point, the following information is displayed: SSID, MAC Address, Device Manufacturer , PHY Type, Channel, RSSI, Security, Beacons Count, Probe Responses Count, Data Bytes, Retransmitted Data Bytes, and more. For every client, the following information is displayed: MAC Address, Device Manufacturer, SSID list that the client tries to connect, Sent Data Bytes, Received Data Bytes, Probe Requests Count, and more.

WifiDiagnosticsView is a Wifi diagnostics tool that monitors the wireless network service of Windows operating system and displays any event that occurs while WifiDiagnosticsView is running, including wireless networks scan, connect to access point, disconnect from access point, failed connection attempt, and so on.

WifiHistoryView is a simple tool that displays the history of connections to wireless networks on your computer. For every event that the computer connected to a wireless network or disconnected from it, the following information is displayed: The date/time that the event occurred, network name (SSID), profile name, network adapter name, BSSID of the router/Access Point, and more.

WifiInfoView scans the wireless networks in your area and displays extensive information about them, including: Network Name (SSID), MAC Address, PHY Type (802.11g or 802.11n), RSSI, Signal Quality, Frequency, Channel Number, Maximum Speed, Company Name, Router Model and Router Name (Only for routers that provides this information), and more.

WinCrashReport provides an alternative to the built-in crash reporting program of Windows operating system. When application crashes in your system and Windows displays the internal crash window of the operating system, you can run WinCrashReport, and get extensive report about the crashed application.

WinDefLogView is a tool that reads the event log of Windows Defender (Microsoft-Windows-Windows Defender/Operational) and displays a log of threats detected by Windows Defender on your system. For every log line, the following information is displayed: Filename, Detect Time, Threat Name, Severity, Category, Detection User, Action, Origin, and more.

WinDefThreatsView is tool for Windows 10 that displays the list of all threats detected by Windows Defender Antivirus and allows you to easily set the default action (Allow, Quarantine, Clean, Remove, Block, or No Action) for multiple threats at once.

WinExplorer is a utility that shows all system's windows in hierarchical display. For every window in the hierarchy, you can view its properties, like handle, class name, caption, size, position and more. You can also modify some properties, like Caption and Visible/Enable.

WinFontsView is a small utility that enumerates all fonts installed on your system, and displays them in one simple table. For each font, WinFontsView draws 5 samples of the font in different sizes, in order to allow you to easily find and choose the desired font that you need. WinFontsView also allows you to view the fonts as Bold, as Italic or with underline, as well as it allows you to export the fonts list into html file.

This utility displays the list of opened windows on your system. For each window, some useful information is displayed: the title, the handle of window, location, size, class name, process number, the name of the program that created the window, and more... In addition, you can easily hide, show or close the selected windows, or save the windows list to text or HTML file.

WinLogOnView is a simple tool that analyses the security event log of Windows operating system, and detects the date/time that users logged on and logged off. For every time that a user log on/log off to your system, the following information is displayed: Logon ID, User Name, Domain, Computer, Logon Time, Logoff Time, Duration, and network address.

WinPrefetchView is a small utility that reads the Prefetch files stored in your system and display the information stored in them. By looking in these files, you can learn which files every application is using, and which files are loaded on Windows boot.

This utility displays the details of all Winsock service providers installed on your system. For every Winsock service, the following information is displayed: Display Name, Status (Enabled/Disabled), DLL Type (32-bit or 64-bit), DLL Filename, DLL Description/Version, and Created/Modified Time.

WinUpdatesList displays the list of all Windows updates (Service Packs and Hotfixes) installed on your local computer. For hotfix updates, this utility also displays the list of files updated with these hotfixes. In addition, it allows you to instantly open the Web link in Microsoft Web site that provides more information about the selected update, uninstall an update, copy the update information to the clipboard, or save it to text/HTML/XML file.

WinUpdatesView is a simple tool that displays the history of Windows updates on your system. WinUpdatesView can load the Windows updates history from your local system, using API, and it can also read and parse the Windows updates database file (DataStore.edb) from external drive or from remote computer on your network.

Wireless Network Watcher is a small utility that scans your wireless network and displays the list of all computers and devices that are currently connected to your network. For every computer or device that is connected to your network, the following information is displayed: IP address, MAC address, the company that manufactured the network card, and optionally the computer name.

WirelessConnectionInfo is a simple tool that displays general information and statistics about the active wifi connection, including the SSID, BSSID, PHY Type, Signal Quality, Receiving rate, Transmission Rate, Authentication Algorithm, Channel Number, Total number of transmitted/received frames, and more.

WirelessNetConsole is a small console application that dumps all current detected wireless networks information into the standard output. For each wireless network, the following information is displayed: SSID, Signal Quality in %, PHY types, RSSI, MAC Address, Channel Frequency, and more.

WirelessNetView is a small utility that runs in the background, and monitor the activity of wireless networks around you. For each detected network, it displays the following information: SSID, Last Signal Quality, Average Signal Quality, Detection Counter, Authentication Algorithm, Cipher Algorithm, MAC Address, RSSI, Channel Frequency, Channel Number, and more.

The ZipInstaller utility installs and uninstalls applications and utilities that do not provide an internal installation program. You can use this utility to install and uninstall all other utilities in this Web site.

A unique, comprehensive, accurate utility to determine the exact performance of local and remote DNS nameservers.

"Everything" is a search engine that locates files and folders by filename instantly. Unlike Windows search "Everything" initially displays every file and folder on your computer. "Everything" only indexes file and folder names and generally takes a few seconds to build its database.

InControl is a one-button utility which gives users control over all non-security updates to their Windows 10 and 11 systems. InControl controls Windows automatic updating/upgrading system by targeting it to a specific major version and feature update release.

InSpectre is an easy to use & understand utility designed to clarify the many overlapping and confusing aspects of any Windows system's ability to prevent the Meltdown and Spectre attacks.

Pageant is an SSH authentication agent for PuTTY, PSCP, PSFTP, and Plink.

Plink is a command-line interface to the PuTTY back ends.

PSCP, the PuTTY Secure Copy client, is a tool for transferring files securely between computers using an SSH connection.

PSFTP, the PuTTY SFTP client, is a tool for transferring files securely between computers using an SSH connection.

PuTTY is a free implementation of SSH and Telnet for Windows and Unix platforms, along with an xterm terminal emulator.

PuTTYgen is a RSA and DSA key generation utility.

A lightweight and intuitive Telnet and Rlogin client application that enables you to initiate remote connections to a multi-user computer.

Rufus is a utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc.

Sumatra PDF is a free PDF, eBook (ePub, Mobi), XPS, DjVu, CHM, Comic Book (CBZ and CBR) reader. Sumatra PDF is powerful, small, portable and starts up very fast. Simplicity of the user interface has a high priority.

DirList allows to browse all connected disks like explorer and select folders and files for listing. Files can be listed by content too. Result listing can be saved to CSV file or as HTML with defined layout with preview.

E-mail History Browser collects and displays e-mail communication history taken from supported e-mail clients in comprehensive interface with powerful filtering engine. Supported e-mail clients: Microsoft Outlook Express, Microsoft Windows Mail, Microsoft Windows Live Mail, Mozilla Thunderbird.

EXE Explorer reads and displays executable file properties and structure. It is compatible with PE32 (Portable Executable), PE32+ (64bit), NE (Windows 3.x New Executable) and VxD (Windows 9x Virtual Device Driver) file types. .NET executables are supported too.

HexEdit is powerfull hexadecimal editor with following features: MDI interface, Data Inspector, Calculator, File Compare, Memory Dumper, Disk Dumper.

Application for browsing, searching, extracting and managing icons in/from files and libraries. This tool allows to manage icon libraries, standalone icons and executable that contains icons as resources.

Internet History Browser collects and displays internet browsing history in comprehensive interface with powerful filtering engine. Supported browsers: Microsoft Edge, Internet Explorer, Google Chrome, Opera, Apple Safari, Mozilla Firefox, Mozilla SeaMonkey, Vivaldi.

Full featured JSON Viewer. Features: hierarchical and text preview, text searching, Base64 encoding/decoding, simple JSON Editor with JSON validation.

Viewer for standalone files containing Microsoft Outlook Express message database (*.idx/*.mbx/*.dbx), Windows Vista Mail/Windows Live Mail and Mozilla Thunderbird message databases as well as standalone EML files.

Network Meter scans for network interfaces and adapters installed in system and their monitoring. Detailed info for every interface is provided. Every interface monitor has simple statistics view and graphic display with time history.

Network Scanner is a multi-threaded ICMP, Port, IP, NetBIOS, ActiveDirectory and SNMP scanner with many advanced features. The program performs ping sweep, scans for opened TCP and UDP ports, resource shares and services. For devices with SNMP capability available interfaces are detected and basic properties displayed.

Image viewer with thumbnail band for fast navigation. Provides EXIF information, RGB/I histogram and some basic image processing tools.

SMBIOS Explorer (SMBE) offers powerful SMBIOS (System Management BIOS) exploring its data in hexadecimal mode, as data converted to structures respecting SMBIOS versions or as fully user-readable translated data in comprehensive browser.

SQLite Query provides complete management of any SQLite3 database. It contains following modules: SQL Editor, Table Editor, Trigger Explorer, SQL History.

Structured Storage Viewer allows to completely manage any MS OLE Structured Storage based file. You can save and load streams, add, delete, rename and edit items and property sets. Embedded streams can be viewed as hexadecimal listing, text, bitmap, icon or RTF.

System Information X provides complex system information about your system. It has capability to save brief text of full XML report and store data in structured storage file (readable by using standard Windows API), that can be lately viewed as well.

Task Manager DeLuxe (TMX) offers powerfull features available in standard Windows Task Manager in lightweight portable package with many more enhancements. TMX provides real-time observing of: running processes, installed services and drivers, available network adapters, network connections by process, network traffic, disk and I/O utilization, active terminal sessions, autostart entries, cpu usage, frequency and other advanced stats, memory map and utilization, opened/locked files finder.

Windows File Analyzer decodes and analyzes some special files used by Windows OS. In these files is interesting information for forensic analysis.

Windows Registry Recovery allows to read files containing Windows registry hives. It extracts many useful information about configuration and windows installation settings of host machine. Registry hive can be exported into REGEDIT4 format.

Full featured XML Viewer. Features: hierarchical and text preview, text searching, Base64 decoding, attribute listing, image interpretation, web and content preview, very fast SAX parser, large files up to available memory, simple XML Editor with xml validation.