add new tools

CHANGELOG.md

@@ -12,6 +12,8 @@ This document provides detailed updates on the changes, improvements, and occasi
 - Add Fiddler
 - Add Magic Extractor
 - Add Network category (CurrPorts, RawCap, TCPView, mitmproxy, Fiddler)
+- Add DeepTaskScan
+- Add WMISubscriptionsView
 - Add installer option to restore the classic context menu on Windows 11
 
 ### 🔧 Changed

TOOLS.md

@@ -497,6 +497,11 @@ Software and techniques for reversing engineering.
 ## 🛡 Rootkits Detector
 Tools specifically for detecting and handling rootkits.
 
+### DeepTaskScan
+- **Web:** https://deuteriumsoftware.com/software/deeptaskscan/
+- **Developer:** Deuterium Software
+- **Description:** DeepTaskScan is a Windows forensics utility that uncovers scheduled tasks hidden by advanced techniques (eg. file and registry deletion), detecting far more entries than Task Scheduler, PowerShell, or other standard tools. Useful for APT investigation and security audits.
+
 ### GMER
 - **Web:** www.gmer.net
 - **Developer:** The GMER dev team.
@@ -512,6 +517,11 @@ Tools specifically for detecting and handling rootkits.
 - **Developer:**  Axt Müller (AxtMueller)
 - **Description:** Windows Kernel Explorer is a free but powerful kernel research tool. It supports from Windows XP to Windows 11. Compared with WIN64AST and PCHunter, WKE can run on the latest Windows 11 without updating binary files.
 
+### WMISubscriptionsView
+- **Web:** https://deuteriumsoftware.com/software/wmisubscriptionsview/
+- **Developer:** Deuterium Software
+- **Description:** WMISubscriptionsView lists Windows Management Instrumentation (WMI) event subscriptions and lets you view, export, create, and delete them, flagging suspicious subscriptions (eg. those running PowerShell or cmd) used by fileless malware for persistence.
+
 
 ## 📦 UnPacking
 Utilities for unpacking and decompressing files and binaries.

bin/installer/iss/full/sections/rootkits-detector.iss

@@ -8,9 +8,22 @@ Filename: "{sys}\attrib.exe"; Parameters: "+r ""{#MyAppBinsFolder}\sendto\sendto
 
 
 
+; DeepTaskScan
+[Components]
+Name: "rootkitsdetector\deeptaskscan"; Description: "DeepTaskScan"; Types: full;
+
+[Files]
+Source: "{#MySrcDir}\toolkit\Rootkits Detector\DeepTaskScan\*"; DestDir: "{#MyAppToolsFolder}\Rootkits Detector\DeepTaskScan"; Components: "rootkitsdetector\deeptaskscan"; Flags: ignoreversion recursesubdirs createallsubdirs;
+
+[Icons]
+Name: "{group}\DeepTaskScan"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\DeepTaskScan\DeepTaskScan64.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\DeepTaskScan"; Components: "rootkitsdetector\deeptaskscan";
+Name: "{#MyAppBinsFolder}\sendto\sendto\Rootkits Detector\DeepTaskScan"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\DeepTaskScan\DeepTaskScan64.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\DeepTaskScan"; Components: "rootkitsdetector\deeptaskscan";
+
+
+
 ; GMER
 [Components]
-Name: "rootkitsdetector\gmer"; Description: "GMER"; Types: full compact; 
+Name: "rootkitsdetector\gmer"; Description: "GMER"; Types: full compact;
 
 [Files]
 Source: "{#MySrcDir}\toolkit\Rootkits Detector\GMER\*"; DestDir: "{#MyAppToolsFolder}\Rootkits Detector\GMER"; Components: "rootkitsdetector\gmer"; Flags: ignoreversion recursesubdirs createallsubdirs; 
@@ -43,6 +56,19 @@ Source: "{#MySrcDir}\toolkit\Rootkits Detector\Windows Kernel Explorer\*"; DestD
 
 [Icons]
 Name: "{group}\Windows Kernel Explorer x64"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\Windows Kernel Explorer\WKE64.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\Windows Kernel Explorer"; Components: "rootkitsdetector\windowskernelexplorer";   Check: Is64BitInstallMode; 
-Name: "{#MyAppBinsFolder}\sendto\sendto\Rootkits Detector\Windows Kernel Explorer x64"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\Windows Kernel Explorer\WKE64.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\Windows Kernel Explorer"; Components: "rootkitsdetector\windowskernelexplorer";   Check: Is64BitInstallMode; 
+Name: "{#MyAppBinsFolder}\sendto\sendto\Rootkits Detector\Windows Kernel Explorer x64"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\Windows Kernel Explorer\WKE64.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\Windows Kernel Explorer"; Components: "rootkitsdetector\windowskernelexplorer";   Check: Is64BitInstallMode;
+
+
+
+; WMISubscriptionsView
+[Components]
+Name: "rootkitsdetector\wmisubscriptionsview"; Description: "WMISubscriptionsView"; Types: full;
+
+[Files]
+Source: "{#MySrcDir}\toolkit\Rootkits Detector\WMISubscriptionsView\*"; DestDir: "{#MyAppToolsFolder}\Rootkits Detector\WMISubscriptionsView"; Components: "rootkitsdetector\wmisubscriptionsview"; Flags: ignoreversion recursesubdirs createallsubdirs;
+
+[Icons]
+Name: "{group}\WMISubscriptionsView"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\WMISubscriptionsView\WMISubscriptionsView.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\WMISubscriptionsView"; Components: "rootkitsdetector\wmisubscriptionsview";
+Name: "{#MyAppBinsFolder}\sendto\sendto\Rootkits Detector\WMISubscriptionsView"; Filename: "{#MyAppToolsFolder}\Rootkits Detector\WMISubscriptionsView\WMISubscriptionsView.exe"; WorkingDir: "{#MyAppToolsFolder}\Rootkits Detector\WMISubscriptionsView"; Components: "rootkitsdetector\wmisubscriptionsview";
 
 

bin/updater/tools.ini

@@ -449,6 +449,22 @@ from = web
 local_version = 2.2.19882
 re_version = <STRONG>GMER (.*?)<\/STRONG>
 
+[DeepTaskScan]
+folder = ..\..\toolkit\Rootkits Detector\DeepTaskScan
+url = https://deuteriumsoftware.com/software/deeptaskscan/
+from = web
+local_version = 1.1.0
+re_version = v(.*?) \(Portable\)
+update_url = https://deuteriumsoftware.com/software/deeptaskscan/DeepTaskScan64.zip
+
+[WMISubscriptionsView]
+folder = ..\..\toolkit\Rootkits Detector\WMISubscriptionsView
+url = https://deuteriumsoftware.com/software/wmisubscriptionsview/
+from = web
+local_version = 1.1.1
+re_version = v(.*?) \(Portable\)
+update_url = https://deuteriumsoftware.com/software/wmisubscriptionsview/WMISubscriptionsView.zip
+
 [de4dotEx]
 folder = ..\..\toolkit\UnPacking\de4dotEx
 url = GDATAAdvancedAnalytics/de4dotEx