IT admin
Approving a new tool
The installer runs in a disposable VM; the report shows two services, a scheduled updater and connections to three known organisations, and goes into the approval ticket.
Coming SoonPro editionSystem & diagnostics
App Inventory & Behaviour Report
Know what an app does on your PC: pick an installed Windows program and get one plain-language report of its files, startup entries, services, scheduled tasks and browser add-ons, the network destinations it contacts, its publisher signature, update behaviour and declared open-source licences, watched over days or tried first in a disposable sandbox, without decompiling or changing anything.
The problem
'What did this program put on my PC, and who does it talk to?' is a fair question that takes five expert tools to answer: Autoruns for startup, Process Monitor for files and registry, TCPView or a firewall log for connections, the certificate dialog for the publisher, and a search for what the licence notices mean. IT teams need the same answer before approving software, and it usually ends up as a guess or a vendor questionnaire.
Features
- One app, one page: everything that belongs to the program, found from its installer records, folders, services, tasks, startup entries, shell extensions and browser add-ons, in plain words, with anything that runs without being opened called out
- Network destinations by app and by day, named by organisation and purpose where known (updates, telemetry, advertising, content), with volumes and first-seen dates, using connection records only and never reading the content
- Trust at a glance: publisher signature and whether it is valid, whether every component is signed by the same publisher, the update channel, and declared open-source components taken from the licence notices and package manifests the app ships
- Try before you trust: run an installer in Sandbox Launcher or a disposable Hyper-V VM and get the same report before it touches the real PC; or compare two versions of an app to see what an update added
- Approve with evidence: export the report for an IT approval or an audit, and turn its findings into actions in the tools that own them, such as a Firewall Rule Manager rule, a startup entry disabled with undo, or a clean removal
How it works
Inventory
- Installer records (Windows Installer, MSIX and the uninstall registry), program folders, services, tasks, Run keys, shell extensions and browser add-ons, attributed to one app
- Authenticode checks per component; update mechanism identified from its tasks and services
Behaviour
- Event Tracing for Windows for process, file, registry and connection events, summarised; a watch of chosen length with low overhead
- Destinations resolved to organisations through DNS and a local list; connection metadata only, no packet content
Licences and reports
- Third-party notice files and package manifests read as shipped; nothing is unpacked or decompiled; 'declared' is shown as declared
- PDF and Markdown report, version comparison, hand-offs to Firewall Rule Manager, Startup & Autoruns Manager and Sandbox Launcher
Who it is for
Home user
The slow laptop
A photo app turns out to run a startup helper and an updater all day; the helper is disabled with undo and the app still works.
Small business owner
What changed in the update?
Comparing two versions shows a new telemetry destination and a browser add-on; the owner blocks one and removes the other in the tools the report links to.
Benefits
- Everything an app installed and runs, on one page
- Who it connects to, by organisation and purpose
- Evidence for approving software, before or after install
Built to be trusted
- Read-only: the report changes nothing; actions happen only in the owning tool, previewed and reversible
- No decompiling, unpacking, patching or injection into the app
- Connection metadata only; no content captured
- Findings are stated as observed, with the period watched
Good to know
The report shows what was observed during the watch, so behaviour that only happens monthly or on a trigger can be missed, and software that detects a sandbox may behave differently there. Connection destinations are named on a best-effort basis, because shared cloud and CDN addresses often say little about purpose; encrypted content is never read, so it can say where data went and how much, not what it was. Declared licences are only what the app ships. It is not an antivirus and gives no safe or unsafe verdict; Antivirus Guard does that work.
Under the hood
For technical readers
- Event Tracing for Windows
- Windows Installer, MSIX, registry, Task Scheduler, Service Control Manager
- WinVerifyTrust; DNS with a local organisation list
- Sandbox Launcher, Desktop VM Studio, Install Watch, Firewall Rule Manager; Reports, Jobs
Related products
Works well with
Coming SoonSite edition
Golden Image Studio
System & diagnostics
Set up Windows once, perfectly, then put that exact setup on every other machine in minutes.
Coming SoonPro edition
Windows Version Manager
System & diagnostics
Know where every PC stands and move it forward safely.
Coming SoonFree edition
Printer Doctor & Print Studio
System & diagnostics
Printers that work and printing that costs less.
Coming Soon
Notify me when App Inventory & Behaviour Report is ready
App Inventory & Behaviour Report is planned for a later release. Leave your e-mail address and we will write once when it becomes available. We ask you to confirm your address first, and you can unsubscribe at any time.
Questions now? Contact our team.