mandiant · vm-packages · Mar 11, 2026 · Mar 11, 2026 · Mar 11, 2026 · Mar 11, 2026
diff --git a/packages/apktool.vm/apktool.vm.nuspec b/packages/apktool.vm/apktool.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>apktool.vm</id>
-    <version>2.12.1</version>
+    <version>3.0.1</version>
     <authors>Connor Tumbleson, Ryszard Wisniewski</authors>
     <description>A tool for reverse engineering 3rd party, closed, binary Android apps.</description>
     <dependencies>

diff --git a/packages/apktool.vm/tools/chocolateyinstall.ps1 b/packages/apktool.vm/tools/chocolateyinstall.ps1
@@ -15,8 +15,8 @@ try {
 
   # Download apktool.jar
   $toolPath = Join-Path $rawToolPath "$toolName.jar"
-  $toolSource = 'https://github.com/iBotPeaches/Apktool/releases/download/v2.12.1/apktool_2.12.1.jar'
-  $toolChecksum = "66cf4524a4a45a7f56567d08b2c9b6ec237bcdd78cee69fd4a59c8a0243aeafa"
+  $toolSource = 'https://github.com/iBotPeaches/Apktool/releases/download/v3.0.1/apktool_3.0.1.jar'
+  $toolChecksum = "b947b945b4bc455609ba768d071b64d9e63834079898dbaae15b67bf03bcd362"
   Get-ChocolateyWebFile -PackageName $toolName -FileFullPath $toolPath -Url $toolSource -Checksum $toolChecksum -ChecksumType "sha256"
   VM-Assert-Path $toolPath
 

diff --git a/packages/chainsaw.vm/chainsaw.vm.nuspec b/packages/chainsaw.vm/chainsaw.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>chainsaw.vm</id>
-    <version>2.13.1</version>
+    <version>2.14.1</version>
     <authors>WithSecure Labs</authors>
     <description>Chainsaw provides a powerful 'first-response' capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file.</description>
     <dependencies>

diff --git a/packages/chainsaw.vm/tools/chocolateyinstall.ps1 b/packages/chainsaw.vm/tools/chocolateyinstall.ps1
@@ -4,8 +4,8 @@ Import-Module vm.common -Force -DisableNameChecking
 $toolName = 'chainsaw'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
-$zipUrl = 'https://github.com/WithSecureLabs/chainsaw/releases/download/v2.13.1/chainsaw_all_platforms+rules.zip'
-$zipSha256 = '6f047599a02172bf4ec165b4df29a915637f30887d920120540a3c0abafe52ef'
+$zipUrl = 'https://github.com/WithSecureLabs/chainsaw/releases/download/v2.14.1/chainsaw_all_platforms+rules.zip'
+$zipSha256 = 'c97c734bfa4d3df08e9585173d101f7cf668e4dc1e182b4a9dfa6d53226e4272'
 
 $executableName = $toolName + "_x86_64-pc-windows-msvc.exe"
 

diff --git a/packages/cygwin.vm/cygwin.vm.nuspec b/packages/cygwin.vm/cygwin.vm.nuspec
@@ -2,12 +2,12 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>cygwin.vm</id>
-    <version>3.6.5</version>
+    <version>3.6.7</version>
     <description>cygwin (Unix-like environment and command-line interface) and useful cygwin packages.</description>
     <authors>Red Hat Inc.</authors>
     <dependencies>
       <dependency id="common.vm"  version="0.0.0.20250206" />
-      <dependency id="cygwin" version="[3.6.5]" />
+      <dependency id="cygwin" version="[3.6.7]" />
     </dependencies>
     <tags>Productivity Tools</tags>
     <projectUrl>https://www.cygwin.com</projectUrl>

diff --git a/packages/goresym.vm/goresym.vm.nuspec b/packages/goresym.vm/goresym.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>goresym.vm</id>
-    <version>3.1.2</version>
+    <version>3.3</version>
     <authors>stevemk14ebr</authors>
     <description>GoReSym is a Go symbol recovery tool.</description>
     <dependencies>

diff --git a/packages/goresym.vm/tools/chocolateyinstall.ps1 b/packages/goresym.vm/tools/chocolateyinstall.ps1
@@ -4,7 +4,7 @@ Import-Module vm.common -Force -DisableNameChecking
 $toolName = 'GoReSym'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
-$zipUrl = 'https://github.com/mandiant/GoReSym/releases/download/v3.1.2/GoReSym-windows.zip'
-$zipSha256 = 'bcad66f944ba528d6a71fd709ca8f7ac0e1cff094eae80f458e1dd335c985e05'
+$zipUrl = 'https://github.com/mandiant/GoReSym/releases/download/v3.3/GoReSym-windows.zip'
+$zipSha256 = '7015ba45e94ef19e212e363d7b165fcef729e090c62ec82a227f5a605d3cd2cb'
 
 VM-Install-From-Zip $toolName $category $zipUrl -zipSha256 $zipSha256 -consoleApp $true -arguments "--help"
diff --git a/packages/hayabusa.vm/hayabusa.vm.nuspec b/packages/hayabusa.vm/hayabusa.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>hayabusa.vm</id>
-    <version>3.7.0</version>
+    <version>3.8.1</version>
     <authors>Yamato Security</authors>
     <description>Windows event log fast forensics timeline generator and threat hunting tool</description>
     <dependencies>

diff --git a/packages/hayabusa.vm/tools/chocolateyinstall.ps1 b/packages/hayabusa.vm/tools/chocolateyinstall.ps1
@@ -4,9 +4,9 @@ Import-Module vm.common -Force -DisableNameChecking
 $toolName = 'hayabusa'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
-$zipUrl = "https://github.com/Yamato-Security/hayabusa/releases/download/v3.7.0/hayabusa-3.7.0-win-x64.zip"
-$zipSha256 = '6c5ed99560d0896bb8a38d53f19da5958c461a519d78b989dfdc8462fbf8b227'
+$zipUrl = "https://github.com/Yamato-Security/hayabusa/releases/download/v3.8.1/hayabusa-3.8.1-win-x64.zip"
+$zipSha256 = 'bc60ca3667169939abdb44ad740060277fa75c37efd960398414c208ebb334e2'
 
-$executableName = $toolName.ToLower() + "-3.7.0-win-x64.exe"
+$executableName = $toolName.ToLower() + "-3.8.1-win-x64.exe"
 
 VM-Install-From-Zip $toolName $category $zipUrl -zipSha256 $zipSha256 -consoleApp $true -innerFolder $false -executableName $executableName
diff --git a/packages/notepadplusplus.vm/notepadplusplus.vm.nuspec b/packages/notepadplusplus.vm/notepadplusplus.vm.nuspec
@@ -2,12 +2,12 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>notepadplusplus.vm</id>
-    <version>8.9.1</version>
+    <version>8.9.2</version>
     <description>Notepad++ is a powerful source code editor.</description>
     <authors>Don Ho</authors>
     <dependencies>
       <dependency id="common.vm"  version="0.0.0.20250206" />
-      <dependency id="notepadplusplus" version="[8.9.1]" />
+      <dependency id="notepadplusplus" version="[8.9.2]" />
     </dependencies>
     <tags>Productivity Tools</tags>
     <projectUrl>https://github.com/notepad-plus-plus/notepad-plus-plus</projectUrl>

diff --git a/packages/npcap.vm/npcap.vm.nuspec b/packages/npcap.vm/npcap.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>npcap.vm</id>
-    <version>1.85</version>
+    <version>1.86</version>
     <authors>Nmap Project</authors>
     <description>Npcap is an architecture for packet capture and network analysis for Windows operating systems, consisting of a software library and a network driver.</description>
     <dependencies>

diff --git a/packages/npcap.vm/tools/chocolateyinstall.ps1 b/packages/npcap.vm/tools/chocolateyinstall.ps1
@@ -2,8 +2,8 @@ $ErrorActionPreference = 'Stop'
 Import-Module vm.common -Force -DisableNameChecking
 
 try {
-    $exeUrl = 'https://npcap.com/dist/npcap-1.85.exe'
-    $exeSha256 = '4038de8dfdd254d21ebc3269c21f138695a07de2d2fbe57181ce4c0da87531c7'
+    $exeUrl = 'https://npcap.com/dist/npcap-1.86.exe'
+    $exeSha256 = 'a4f7ab0c5850b819dc7a131213c16a9deaf8d32bceed7131fea38740ea788503'
     $installerName = Split-Path -Path $exeUrl -Leaf
 
     $packageArgs = @{

diff --git a/packages/regcool.vm/regcool.vm.nuspec b/packages/regcool.vm/regcool.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>regcool.vm</id>
-    <version>0.0.0.20260128</version>
+    <version>0.0.0.20260311</version>
     <authors>Kurt Zimmermann</authors>
     <description>RegCool is a flexible editor for the Windows registry database.</description>
     <dependencies>

diff --git a/packages/regcool.vm/tools/chocolateyinstall.ps1 b/packages/regcool.vm/tools/chocolateyinstall.ps1
@@ -5,6 +5,6 @@ $toolName = 'RegCool'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
 $zipUrl = 'https://kurtzimmermann.com/files/RegCoolX64.zip'
-$zipSha256 = '7e979f33f53d734161f8936c452736dd9406deb4560978b424b822351037e514'
+$zipSha256 = '4bcec2705eedd1e82071ebfbd41c36afddd8ac300034e3f2d3c93b22dc50f664'
 
 VM-Install-From-Zip $toolName $category $zipUrl -zipSha256 $zipSha256 -consoleApp $false -innerFolder $false
diff --git a/packages/snaffler.vm/snaffler.vm.nuspec b/packages/snaffler.vm/snaffler.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>snaffler.vm</id>
-    <version>1.0.224</version>
+    <version>1.0.244</version>
     <authors>l0ss, Sh3r4</authors>
     <description>Snaffler is a tool for enumerating accessible SMB shares in an Active Directory environment.</description>
     <dependencies>

diff --git a/packages/snaffler.vm/tools/chocolateyinstall.ps1 b/packages/snaffler.vm/tools/chocolateyinstall.ps1
@@ -4,7 +4,7 @@ Import-Module vm.common -Force -DisableNameChecking
 $toolName = 'Snaffler'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
-$exeUrl = 'https://github.com/SnaffCon/Snaffler/releases/download/1.0.224/Snaffler.exe'
-$exeSha256 = '35295339012ed75ed619c51c3c4d3e8d72b32bf643518a9982f6b614a6afed1e'
+$exeUrl = 'https://github.com/SnaffCon/Snaffler/releases/download/1.0.244/Snaffler.exe'
+$exeSha256 = '397b22a956545ba9cd5f03f0f61cb16e4760db21be97f979a5cfc059c2f854ca'
 
 VM-Install-Single-Exe $toolName $category $exeUrl -exeSha256 $exeSha256 -consoleApp $true
diff --git a/packages/tor-browser.vm/tor-browser.vm.nuspec b/packages/tor-browser.vm/tor-browser.vm.nuspec
@@ -2,12 +2,12 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>tor-browser.vm</id>
-    <version>15.0.4</version>
+    <version>15.0.7</version>
     <authors>Tor Project</authors>
     <description>The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world.</description>
     <dependencies>
       <dependency id="common.vm"  version="0.0.0.20250206" />
-      <dependency id="tor-browser" version="[15.0.4]" />
+      <dependency id="tor-browser" version="[15.0.7]" />
     </dependencies>
     <tags>Productivity Tools</tags>
   </metadata>

diff --git a/packages/upx.vm/tools/chocolateyinstall.ps1 b/packages/upx.vm/tools/chocolateyinstall.ps1
@@ -4,9 +4,9 @@ Import-Module vm.common -Force -DisableNameChecking
 $toolName = 'upx'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
-$zipUrl = "https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-win32.zip"
-$zipSha256 = "9a0d3dcbcfd56ef1a5fa922af0978d445cc1a4ec25609639ccb8db369a49be03"
-$zipUrl_64 = 'https://github.com/upx/upx/releases/download/v5.1.0/upx-5.1.0-win64.zip'
-$zipSha256_64 = '41c7492edeed0f7e67d347ca9e8d2131e2af7ca7a7695f92283a8e655c251c13'
+$zipUrl = "https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win32.zip"
+$zipSha256 = "c0fc8553784ad64145c37a6379f7aa2daf143580437792e862ba6f4630e9f0da"
+$zipUrl_64 = 'https://github.com/upx/upx/releases/download/v5.1.1/upx-5.1.1-win64.zip'
+$zipSha256_64 = 'fa5380bca4c2718547aaa0134bc0d8a7fa27e102f0ac6371573d60d1c21d64de'
 
 VM-Install-From-Zip $toolName $category $zipUrl -zipSha256 $zipSha256 -zipUrl_64 $zipUrl_64 -zipSha256_64 $zipSha256_64 -consoleApp $true -innerFolder $true
diff --git a/packages/upx.vm/upx.vm.nuspec b/packages/upx.vm/upx.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>upx.vm</id>
-    <version>5.1.0</version>
+    <version>5.1.1</version>
     <authors>markus-oberhumer</authors>
     <description>UPX is a free, secure, portable, extendable, high-performance executable packer for several executable formats.</description>
     <dependencies>

diff --git a/packages/vb-decompiler-lite.vm/tools/chocolateyinstall.ps1 b/packages/vb-decompiler-lite.vm/tools/chocolateyinstall.ps1
@@ -5,7 +5,7 @@ $toolName = 'VB Decompiler'
 $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
 
 $zipUrl = 'https://www.vb-decompiler.org/files/vb_decompiler_lite.zip'
-$zipSha256 = '163349edab8740d8200da4d49c795144af301cb585892e44099f5edbee7a4707'
+$zipSha256 = 'c81f6feadbf0db68150890fa97b36bc014e7e42f05e32af1c7f69ab6f7f750cb'
 
 $toolDir = Join-Path ${Env:RAW_TOOLS_DIR} $toolName
 $executablePath = (Join-Path $toolDir "$toolName.exe")

diff --git a/packages/vb-decompiler-lite.vm/vb-decompiler-lite.vm.nuspec b/packages/vb-decompiler-lite.vm/vb-decompiler-lite.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>vb-decompiler-lite.vm</id>
-    <version>0.0.0.20260128</version>
+    <version>0.0.0.20260311</version>
     <authors>DotFix Software</authors>
     <description>VB Decompiler is a decompiler for Visual Basic, VB.NET and C# applications.</description>
     <dependencies>

diff --git a/packages/vscode.vm/vscode.vm.nuspec b/packages/vscode.vm/vscode.vm.nuspec
@@ -2,12 +2,12 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>vscode.vm</id>
-    <version>1.108.2</version>
+    <version>1.111.0</version>
     <authors>Microsoft</authors>
     <description>VSCode is a modern, open-source code editor.</description>
     <dependencies>
       <dependency id="common.vm"  version="0.0.0.20250206" />
-      <dependency id="vscode" version="[1.108.2]" />
+      <dependency id="vscode" version="[1.111.0]" />
     </dependencies>
     <tags>Productivity Tools</tags>
   </metadata>

diff --git a/packages/windows-terminal.vm/tools/chocolateyinstall.ps1 b/packages/windows-terminal.vm/tools/chocolateyinstall.ps1
@@ -6,8 +6,8 @@ try {
   $category = VM-Get-Category($MyInvocation.MyCommand.Definition)
   $executableName = "wt.exe"
 
-  $zipUrl = 'https://github.com/microsoft/terminal/releases/download/v1.23.20211.0/Microsoft.WindowsTerminal_1.23.20211.0_x64.zip'
-  $zipSha256 = '83efe4572599479e9df38317a7be7feb1e2e86430432fc8d84f76df19de6cd11'
+  $zipUrl = 'https://github.com/microsoft/terminal/releases/download/v1.24.10621.0/Microsoft.WindowsTerminal_1.24.10621.0_x64.zip'
+  $zipSha256 = 'b7bb1018061ea416512b888a6559ac8a0c4c200c3b4f66bf8c45b3e5ce562236'
 
   $toolDir = Join-Path ${Env:RAW_TOOLS_DIR} $toolName
 

diff --git a/packages/windows-terminal.vm/windows-terminal.vm.nuspec b/packages/windows-terminal.vm/windows-terminal.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>windows-terminal.vm</id>
-    <version>1.23.20211</version>
+    <version>1.24.10621</version>
     <authors>Microsoft</authors>
     <description>Windows Terminal is a new, modern, feature-rich, productive terminal application for command-line users.</description>
     <dependencies>

diff --git a/packages/wireshark.vm/wireshark.vm.nuspec b/packages/wireshark.vm/wireshark.vm.nuspec
@@ -2,13 +2,13 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>wireshark.vm</id>
-    <version>4.6.3</version>
+    <version>4.6.4</version>
     <description>Wireshark lets you capture and interactively browse the traffic running on a computer network.</description>
     <authors>Gerald Combs, Wireshark team</authors>
     <dependencies>
       <dependency id="common.vm"  version="0.0.0.20250206" />
       <dependency id="npcap.vm" />
-      <dependency id="wireshark" version="[4.6.3]" />
+      <dependency id="wireshark" version="[4.6.4]" />
     </dependencies>
     <tags>Networking</tags>
   </metadata>