Skip to content

Instantly share code, notes, and snippets.

@Beercow
Last active April 5, 2022 11:35
Show Gist options
  • Save Beercow/f8d43591c960f6fff1451ab5a6f629bc to your computer and use it in GitHub Desktop.
Save Beercow/f8d43591c960f6fff1451ab5a6f629bc to your computer and use it in GitHub Desktop.
NirLauncher package to add Eric Zimmerman's Tools
[General]
SoftwareCount=21
GroupCount=3
Name=Eric Zimmerman Tools
[Group0]
name=Command-Line Utilities
[Group1]
name=GUI Utilities
[Group2]
name=All Utilities
ShowAll=1
[Software0]
exe=AmcacheParser.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/AmcacheParser.zip
group=0
Name=AmcacheParser
AppName=AmcacheParser
ShortDesc=Amcache.hve parser with lots of extra features. Handles locked files
LongDesc=
[Software1]
exe=AppCompatCacheParser.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/AppCompatCacheParser.zip
group=0
Name=AppCompatCacheParser
AppName=AppCompatCacheParser
ShortDesc=AppCompatCache aka ShimCache parser. Handles locked files
LongDesc=
[Software2]
exe=JumpList Explorer\JLECmd.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip
group=0
Name=JLECmd
AppName=JLECmd
ShortDesc=Jump List parser
LongDesc=
[Software3]
exe=JumpList Explorer\JumpListExplorer.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/JumpListExplorer.zip
group=1
Name=JumpListExplorer
AppName=JumpListExplorer
ShortDesc=GUI based Jump List viewer
LongDesc=
[Software4]
exe=LECmd.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/LECmd.zip
group=0
Name=LECmd
AppName=LECmd
ShortDesc=Parse lnk files
LongDesc=
[Software5]
exe=MFTECmd.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/MFTECmd.zip
group=0
Name=MFTECmd
AppName=MFTECmd
ShortDesc=$MFT, $Boot, $J, $SDS, and $LogFile parser. Handles locked files
LongDesc=
[Software6]
exe=PECmd.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/PECmd.zip
group=0
Name=PECmd
AppName=PECmd
ShortDesc=Prefetch parser
LongDesc=
[Software7]
exe=RecentFileCacheParser.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/RecentFileCacheParser.zip
group=0
Name=RecentFileCacheParser
AppName=RecentFileCacheParser
ShortDesc=RecentFileCache parser
LongDesc=
[Software8]
exe=ShellBags Explorer\SBECmd.exe
url=https://ericzimmerman.github.io/Software/SDBExplorer.zip
group=0
Name=SBECmd
AppName=SBECmd
ShortDesc=Shellbags parser
LongDesc=
[Software9]
exe=SDBExplorer\SDBExplorer.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/SDBExplorer.zip
group=1
Name=SDBExplorer
AppName=SDBExplorer
ShortDesc=Shim database GUI
LongDesc=
[Software10]
exe=ShellBags Explorer\ShellBagsExplorer.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/ShellBagsExplorer.zip
group=1
Name=ShellBagsExplorer
help=ShellBags Explorer\ShellBagsExplorerManual.pdf
AppName=ShellBagsExplorer
ShortDesc=GUI for browsing shellbags data. Handles locked files
LongDesc=
[Software11]
exe=Timeline explorer\TimelineExplorer.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/TimelineExplorer.zip
group=1
Name=TimelineExplorer
AppName=TimelineExplorer
ShortDesc=View CSV and Excel files, filter, group, sort, etc. with ease
LongDesc=
[Software12]
exe=WxTCmd.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/WxTCmd.zip
group=0
Name=WxTCmd
AppName=WxTCmd
ShortDesc=Windows 10 Timeline database parser
LongDesc=
[Software13]
exe=Registry Explorer RECmd\RegistryExplorer.exe
help=Registry Explorer RECmd\RegistryExplorerManual.pdf
url=Registy viewer with searching, multi-hive support, plugins, and more. Handles locked files
group=1
Name=RegistryExplorer
AppName=RegistryExplorer
ShortDesc=Registy viewer with searching, multi-hive support, plugins, and more
LongDesc=
[Software14]
exe=Registry Explorer RECmd\RECmd\RECmd.exe
url=Registy viewer with searching, multi-hive support, plugins, and more. Handles locked files
group=0
Name=RECmd
AppName=RECmd
ShortDesc=Registy viewer with searching, multi-hive support, plugins, and more
LongDesc=
[Software15]
exe=VSCMount.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/VSCMount.zip
group=0
Name=VSCMount
AppName=VSCMount
ShortDesc=VSCMount. Mount all VSCs on a drive letter to a given mount point
LongDesc=
[Software16]
exe=hasher\Hasher.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/hasher.zip
group=1
Name=Hasher
AppName=Hasher
ShortDesc=Hash all the things
LongDesc=
[Software17]
exe=bstrings.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/bstrings.zip
group=0
Name=Bstrings
AppName=Bstrings
ShortDesc=Find them strings yo. Built in regex patterns. Handles locked files
LongDesc=
[Software18]
exe=RBCmd.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/RBCmd.zip
group=0
Name=RBCmd
AppName=RBCmd
ShortDesc=Recycle Bin artifact (INFO2/$I) parser
LongDesc=
[Software19]
exe=TimeApp.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/TimeApp.zip
group=1
Name=TimeApp
AppName=TimeApp
ShortDesc= A simple app that shows current time (local and UTC) and optionally, public IP address. Great for testing
LongDesc=
[Software20]
exe=iisGeolocate\iisGeolocate.exe
url=https://f001.backblazeb2.com/file/EricZimmermanTools/iisGeolocate.zip
group=0
Name=iisGeolocate
AppName=isiGeolocate
ShortDesc=Geolocate IP addresses found in IIS logs
LongDesc=
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment