Full download in the secure portal. Excellent investigation tool for system admin, investigators, security, compliance and others to use. You can use the app to find hidden files called ADS (alternate data stream) inside of a file. Find out the site where a file was downloaded from. A lot of virus are hiddened this way. You can also hide files in another file using this tool. The tools allows you to change file zones and other things as well. This is a powerful tool, please use the app responsibly. Remember, NTFS allows ADS but FAT32 does not.

Full download in the secure portal. Modern websites often contain hundreds or thousands of interconnected assets. Over time, content accumulates, structures change, and visibility into what is actually exposed to the public becomes limited. The THUGON Website Scanner provides transparency into the real, publicly accessible structure of a website. By rendering pages through a real browser engine and capturing HTTP responses, it produces an accurate structural inventory that reflects how the website behaves in the real world. I used only a single thread when the app crawls a website so that site bot monitoring systems won't ban the app and you from crawling. This will make the crawl look slow but it should get pass site bot monitoring systems. If you find it useful please consider donating. Thank you.

Zero tolerance for compromise. AES256 GCM, XOR, passwords, PK100K iterations, SHA2 hash, n of n and more. Stand alone executable so no install. Windows OS only. Available by request only. Last version 2. You can also use it to split files, to secure them from multiple required access/joins and reconstruction that will require more then one person. Individual password requirement for split and reconstructions. Please remember, this is a n of n. Without all the pieces, and passwords, you cannot reconstruct the file. This is not Shamir's system k of n. This is setup for maximum strength and security.

Overwrite file, random bytes (zeros), encrypt multiple times AES GCM in memory, deletes the file(s)/directory and flush memory. Windows OS only. Key files are only availabled for custom versions (can be unique, hard coded, SHA256 HASH checked) are distributed to authorized users and computers only. The free version does not have key files so you can use it for personal and business uses. This is a must have tool for all. All rights reserved by www.thugon.com.

Full download in the secure portal. This app will generate a report of your random pick of items from an excel sheet. You can input your name, title, reason, how many random picks and etc. Uses the Python SystemRandom() function. Tracks your excel file SHA256 (excel file hash changes when opened, no data change is required). Export report for auditing. Date and time stamp. Names or items listed report. Export report hash file for auditing or compliance tracking.

SystemRandom() is a class in Python's built-in random module. Unlike the standard random number generator, SystemRandom() pulls its randomness from the operating system itself rather than a mathematical formula.

How It Works

When you call SystemRandom(), Python reaches out to the operating system's entropy source. On Linux and Mac this is /dev/urandom and on Windows it uses CryptGenRandom. These sources collect unpredictable data from physical system activity such as mouse movements, keyboard timing, network activity, and hardware noise. That data is used to generate the random numbers.

Why It Matters for Auditing

The standard Python random module uses an algorithm called Mersenne Twister. This is a predictable generator, meaning if someone knows the starting seed value they can predict every number it will produce. This makes it unsuitable for security sensitive applications.

SystemRandom() cannot be seeded or predicted because it relies on the operating system, making it cryptographically secure. This is important for things like shuffling cards in a blackjack game, generating session tokens, creating secure passwords, and any situation where predictability would be a vulnerability.

This app uses SHA-256 to hash files and compare hashes. I built it because I was constantly checking SHA-256 hashes for file downloads and verifications. Now you don't need to remember any command prompt or PowerShell commands. Just run the app and you're ready to go.

Current version: 3

Running the App on Windows

When you download and unzip the file, Windows may silently block the exe from running with no prompt or warning. To fix this, follow these steps:

1. Right click the exe file and select Properties.
2. On the General tab, look near the bottom for a Security message that reads: "This file came from another computer and might be blocked."
3. Check the Unblock checkbox and click Apply.

This happens because of a Windows security feature called SmartScreen, which blocks unrecognized or unsigned executables. Browsers like Chrome and Edge can also flag downloaded zip files the same way. This is known as Mark of the Web (MOTW) and is normal behavior for files downloaded from the internet.

If you find this app useful, please consider making a donation. Thank you.

The THUGON Port and Device Scanner queries Windows Plug-and-Play device information and system event logs to build a live inventory of all hardware devices connected to the system. Devices are categorized by type and status, allowing administrators to quickly identify USB devices, storage devices, network adapters, Bluetooth hardware, and other components. When investigating USB devices, it is important to understand that Windows records information about device installation, connections, users, and activity in multiple locations across the system. Pay particular attention to the earlier discussion on “USERS” logging, as it can provide valuable insights during an investigation. Relevant data sources may include registry keys, event logs, system databases, and user-specific metadata. This tool captures only a subset of these data points, offering initial clues rather than a complete picture. Use these clues to guide a more thorough examination of other sources as needed.

The tool runs locally on your Windows PC with administrator privileges, allowing it to monitor all active network connections. It evaluates connections against configurable rules for: Specific IP addresses VPN traffic thresholds (in MB) Application-specific network activity (process monitoring) When a rule is triggered—such as a connection to a blocked IP, an application sending/receiving excessive data, or other suspicious activity—the tool will **automatically disable your Wi-Fi**, preventing potential data theft from your system.

Full download is located in the secure login portal (You can download the full version and use it. Registration key purchase is separate but not required.) The original application was built in the early 2000s for the 24/7/365 operation of the Surveillance Department. Over the years, I upgraded it to do much more. It is a very powerful application regardless of what industry you are in. The current version added modules for Surveillance, Compliance, Auditing, Investigations, Gaming Commissioners, Gaming regulatory agencies, Security and many other agencies. There are differrent modes as well. This application was built to manage the entire process of many departments or an organization. The list of things that it can do and manage is very long. Here is short list of what it include, nist standards, rotating pin gen, MFA, encryptions, daily log, shift management, request, access, incidents, auditing, investigations, SDS (OSHA), purchasing orders, messaging system, documents/videos management, alerts, suspect profile tracking, inventory, training, memo, KB, evidence control, Tech, gaming items, visitor, jackpot, slot tracking, certification tracking, payment tracking, dispute tracking, close watch, vehicle search, people search, emergency activation, voice commands, vendor tracking, project tracking, time clock, wellness tracking, disciplinary tracking, improvement process, goals, kpi, reports, metrics and much more. It was built to comply with state, federal, tribal and international laws and regulations. Many other modules such as projects, lean sigma and other tools are bonuses. There are around 12 or more applications that comes with the main application also. For example, SHA2, SHA3, SHA1, Password keeper, Agent Long and many others. In 2024-2026 versions, Lily voice system was added. Lily is a voice assistance that you can activate to listen and run commands for you. She can active emergency protocals such as alerting all users to an emergency. The older voice system used an assistance called Yuna. Version 2024 and later was designed to work on Azure desktop.

This was designed for the Macau Taipa Casino Security System. It has been discontinued and is no longer in service.

This was designed to manage farm animals, medical, health, tags and much more. It has been discontinued and is no longer in service.

This application was designed to meet the strict regulations of the state (CA), NIGC, Tribal Gaming Commission and federal regulatory requirements for a casino's employees and vendors suitability, backgrounds, investigations and other requirements. This application is currently used in the industry. You can download the full version from the secure portal. No registration is required.

Before you read on, I want to correct a misconception: Some have stated that I created this software to challenge Konami's SYNK31. That is not true. My Title 31 or T31/MTL was built 12 plus years before Konami's application. Konami's application is NOT free. My Title 31 application is FREE for all casinos. Full download is located in the secure login portal. I have documented this elsewhere on the website: https://www.thugon.com/title31software.html.

I built the first version around 2007, called the MTL, at a Tribal casino in California. Konami showcased their version around 2019–2020. That's about 12 years a part. I originally built this software for the casino industry using the FINCEN schema. This project started between 2007 and 2009 and was initially called the MTL application (MTL = Multi Transaction Log). It was originally requested by a management team of a Tribal casino and approved by the Gaming Commission. I left the Gaming Commission and continued to design the application. The goal was to create an application that could:
• Track all transactions from multiple locations and departments.
• Meet and exceed FINCEN's Anti-Money Laundering (AML) requirements.
• Run with minimal hardware and be cost-efficient, since many companies do not have advanced server management resources.
• Run on a standard Windows computer, which most people would have.

Between 2010 and 2025, I upgraded the software to meet NIST standards and additional FINCEN AML requirements. There are many videos on the YouTube site demonstrating how to use and set up the software.

What I didn’t expect was that this application would become a very useful tool for:
• Check cashing locations
• Money order services
• Businesses falling under Title 31 regulations and requirements to register as an MSB (Money Service Business)

The reporting requirements for these businesses are very similar. At the time of writing this article, the software is FREE to use without registration. It is the full version, provided AS IS / WHERE IS without any guarantee or warranty. You can support me if you choose to register it. You can download the full version in the Secure Portal. Access to the Secure Portal will require a subscription fee.

A short list of features includes:
• KYC (Know Your Customer)
• Training
• Time clock
• SAR (Suspicious Activity Report)
• CTR (Currency Transaction Report)
• MIL (Monetary Instrument Log)
• People tracking
• Incidents
• Memo
• Knowledge base (KB)
• Evidence control
• Admin and supervisor modes
• Lily voice commands
• Shift management
• Etc.

This is a free software. You can use it to track all your invoices, orders and payments. There is a code repository or knowledge base that I use to track notes and design codes. It was retired in 2025 but there may be some free versions floating around.

You can access all (full) blackjack trainings in the secure login portal. The motivation of this training was to train surveillance agents beginning and advance table games strategies particularly blackjack. The training offers: card counting training, basic strategies, shuffle tracking, betting strategies, money management, card training, advance card counting, group play, casino strategies and much more. There are timed quizes, print outs and more. You will need a login to use the training. I built this for the casinos in California but it was taken to Vegas and other areas over the years. Today, it is still being used in casinos. The original CD/DVD were also used for private player group training also. I believe there are a few YouTube videos show how it works.

This is a purchase only app. You can download the full version in the secure login portal. Unlimited use. To register the app, you must purchase a key but it is not required to use the app. Because this software is actively used in casino environments, it is not publicly available for download. You can download this app in the secure login portal. Training materials are available through the YouTube video archive. This system was originally developed during my time as a Surveillance Manager and Director. At the time, available commercial solutions often exceeded $100,000 and did not fully meet our operational needs—particularly in analyzing blackjack play or the price tag was beyond our budget. As a result, I built a solution tailored specifically to real-world surveillance workflows, focusing on flexibility, accuracy, and practical usability.

This database application was designed so that companies that needs a tracking database application to track and run random pick employees for drug testing purposing can meet the company's goals. Stand alone Microsoft Access db. Logging, documentation tracking. Randomize how many employees you would like to pick. Update information. Exclude certain employees. The original design was for Tribal government agencies. Download the full version from the secure login. No registration is required.

Full version download in the secure portal. You can visit the youtube video site to view the how to use video. The Agent Long apps have many different versions. They will obscure text in different formats. There is one utility that was designed to decode all codes based on the "encryption" or "key" used. This app will decode/store all korean hangul and etc. The password keeper db and the agent long apps uses key file verification to run. Without the key files, the apps will not run at all. This is a security feature. There are other versions as well.

You can deploy this on any work station/pc or on a network. Admin will be able to generate reports and categorize what issues are being reported the most and concerns from employees. This is an OSHA requirement. This database just simplify the process. You can visit the YouTube site to view the training video. The full version is available for download in the secure login portal. Make sure you place the key file on all machines that you would like to be able to open the database. This is an application security.

Please view the YouTube video. The video will explain the training then you can use the application for hands on training. I use this to train regulators and investigations on how easily codings can compromise a slot machine and also how difficult it can be to detect. I used some real historical examples in this training. I also coded cheating codes into the application to simulate how malicious codings can compromise a slot machine. It is a valuable, hands on training for all casino employees. This app is downloadable in the secure login section. Some core teaching demonstrates button press demonstration and reel combination or pattern recognitions.

The application is actually a database system that you can import in your employee list and randomly pick employees for investigations. This approach is very fair and can cover employees that you may not have suspected of wrong doing. It is still being used in different industries so the download is only available in the secure login portal. If you would like to use it, please send a request for approval. It is a valuable tool for all organizations concern about a proactive approach in security and investigation process. SPECIAL NOTE: There is a new exe utility that functions similarly to the SR PEO application but without a database. You can find that in the software list called the Random Pick APP. Linked above.

This app requires a key file. Full download in the secure login portal. This is a complimentary app that goes with the GC ONE app and or the Title 31 application. V3.

Full download in the secure login portalThis app requires a key file. You cannot download it without approval. This is a complimentary app that goes with the GC ONE app and or the Title 31 application. V3. This application will also require python. Currently, Windows 11 does not have the sha3 library.

This application was used to extract passwords tables from an access db. It is used in the GC ONE and Title 31 applications in the event of a system lockout only. The last test of this application was in early 2025. Most of the access db password tables are encrypted now. Passwords are not recoverable. This application is not allowed to be downloaded without prior approval.

These were built to randomly rotate a new login pin number for the GC ONE and Title 31 applications. These apps also requires key pins to be used. The calculation of the daily PINs are documented inside of each application in the developer's section. These applications are packaged and available in the secure login portal.

This is a supplemental application to the GC ONE app. It calculates and generates projections to improve employee wellness. It performs the projection and calculations based on the current status of the employee wellness data. It is an excellent tool that is used in the GC ONE wellness tracking section. This is normally only available to supervisors and admins only. This application does all the math and calculation so that the user does not have to manually calculate the projections, improvement rates or goals. You can search the YouTube video archive for training videos. This is key file required. Full download in the secure login portal and packaged with GC ONE app.

This was created for the GC ONE application. It is used to generate unique passwords for locking down applications and logins. This application was last update in the middle of 2025. There are other applicatons that can replace this application although, it is still used in the GC ONE app. This is key file required. There are two version, secured pim required and free version. Full download in the secure login portal.

RECOMMENDED VERSION PYTHON-3.13.0-amd64.exe. Version python version 3.11.2 can/may be used if you can't find 3.13.0. You can download python from their official site. https://www.python.org. Currently, in 2026, this is the correct python version for the GC ONE and Title 31. If you choose to use/run the Lily voice command assistance in the GC ONE and Title 31 apps, you must make sure that you are using the correct version of python. Do not use the latest python version because some wheels will not work on the latest python version. I've included the full install codes here to make the installation as easy as possible so that you will have the correct versions (INSTALL THE CORRECT PYTHON VERSION FIRST BEFORE YOU RUN THE CODES BELOW). Full download in the secure login portal.

Install Required Packages

pip install audioop-lts==0.2.1 certifi==2025.4.26 cffi==1.17.1 charset-normalizer==3.4.2 colorama==0.4.6 comtypes==1.4.11 idna==3.10 PyAudio==0.2.14 pycparser==2.22 pyodbc==5.2.0 pypiwin32==223 pyttsx3==2.98 pywin32==310 requests==2.32.3 sounddevice==0.5.2 SpeechRecognition==3.14.3 srt==3.5.3 standard-aifc==3.13.0 standard-chunk==3.13.0 tqdm==4.67.1 typing_extensions==4.13.2 urllib3==2.4.0 vosk==0.3.45 websockets==15.0.1

The training site is available in the secure login portal, where employees can interact with and observe how attackers capture credentials and authentication codes in real-world scenarios. This hands-on experience reinforces awareness and strengthens defensive practices. Let me know if the site is down. It is normal for the test site to show blank because my hosting provider scans files often and will automatically remove suspicious files. I will reload the test site.

I designed this for the casino industry many years ago. You will learn what I have taught the casinos for decades. As a former casino surveillance manager/director, I designed these trainings to teach the casino's employees. Basic strategy, shuffle tracking and betting strategies are the basic foundations of a strong blackjack player. Shuffle tracking is extremely effective. It is sometimes considered more effective than card counting. You can locate all the card counting trainings in the secure portal.

I designed this app to recover RSA public key from the RSA private key. As long as you have the RSA .pem private key, you can use this app to recover the RSA .pem public key. You must always protect your private keys. App password is in the readme file. A little more info: In RSA cryptography, the public key can be derived from the private key because the private key already contains the public components. Specifically, the public key consists of the modulus (n) and public exponent (e), both of which are stored inside the private key structure. The process of “recovering” the public key is not a new generation step—it is simply extracting these values from the private key and formatting them as a public key. Designed by Seng Thao.

I designed this app to assist government agents, investigators, compliance and IT admin in investigating suspicious email. You can export the report to a pdf. It will accepts eml and msg emails. These are from gmail and outlook files. If you have raw email files, you can rename them to .eml and the app should accept them. You can also manually update the domain databases and doman names in the setup text files. I used maxmind's databases and csv files. Make sure you sign up for an account if you would like to manually download and update them monthly. Please do not use this tool as an offensive tool. It was built as a defense tool. The goal of the tool was to quickly analyze suspicious email and track where it came from. It does have a legal subpoena mapping if you are a government agency. This is a quick list on who to request data and evidence from. Credits: This app uses databases and csv files from www.maxmind.com. Please update them every month or so. You will need a free account with them. You can download the full app in the secure portal.

Email Authentication

SPF — “Is this server allowed?”

• Checks if the sending server is authorized by the domain
• Pass: valid source | Fail: unauthorized

DKIM — “Was it altered?”

• Uses a digital signature to verify message integrity
• Pass: intact | Fail: modified/invalid

DMARC — “Does it match & what now?”

• Combines SPF + DKIM and checks “From” alignment
• Policies: none, quarantine, reject

Quick view:
SPF = source ✔️
DKIM = integrity ✔️
DMARC = identity + action ✔️