HAVOC is a software application that uses small system configuration changes to cause malware to fail at runtime.

Dark-Drive is a USB storage device with specially modified firmware that provides “ghost in the machine” behavior.

PAINT captures network packets and attributes originating and receiving Process IDs (PIDs) and Process Names on in real-time. It optionally integrates with Wireshark for ease of use. PAINT simplifies malware analysis by attributing TCP, UDP, and IP packet activity to the originating and target executable.