Take a suspicious Windows program apart without running it SPECIMEN
The first thing done with a suspicious program is triage: read what it is made of without running it. That normally means a paid tool or uploading the sample to a website. This does it in the tab.
1. The program
A Windows .exe, .dll or .sys you do not trust. It is read here and never run. Nothing is uploaded.
No file open yet.
2. What it is made of
How it works
How to read this, and where it stops
SPECIMEN reports indicators, never a verdict, because every sign it can see appears in honest software too. High entropy means packing, not guilt; injection APIs are in security tools as well as implants. Use it to decide what deserves an analyst's time. Its blind spot is packing: a compressed or encrypted sample hides its real code and strings until it unpacks in memory, which static reading cannot reach - SPECIMEN will say it is packed, and a sandbox is the next step. VOUCH checks whether a signature is genuine and who it names.
Doing this often? The Sovereign Console loads suspicious files as evidence, fingerprints them against hash sets, and pulls every indicator into one report. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.