Tools used in Tweets

Packet capture screenshots:  https://www.wireshark.org/
Traffic spider graphs:  https://github.com/tomchop/malcom
Link download screenshots:  https://www.gnu.org/software/wget/
Web directory screenshots:  http://lynx.browser.org/
Web POST/GET/HEAD tool:  https://github.com/asciimoo/wuzz
Process flow graphs:  http://procdot.com/
Color file diff:  https://github.com/FireyFly/pixd
Exe section breakdown:  https://github.com/DidierStevens/DidierStevensSuite/blob/master/pecheck.py
ASCII histogram:  https://github.com/wizzat/distribution
Static Binary Analysis:  https://github.com/guelfoweb/peframe
C2 traffic screenshots and text search:  https://github.com/silence-is-best/c2db
Sporadically updated JA3 of malicious traffic:  https://github.com/silence-is-best/ja3
Strings from files: Stringex+ https://pastebin.com/AQAA9gKx

wireshark columns: https://pastebin.com/LsQzcrTD
wireshark filters: https://pastebin.com/2SE6q5uh

Online tools:
Great decoder: https://gchq.github.io/CyberChef/
Office Doc Dropper Analysis: https://malware.sekoia.fr/new
Office Doc Analysis: https://iris-h.malwageddon.com/submit

Trackers:
http://tracker.h3x.eu/families
https://ransomwaretracker.abuse.ch/tracker/
http://benkow.cc/passwords.php
http://cybercrime-tracker.net/
https://urlhaus.abuse.ch/

IOC feeds:
https://www.hashdd.com/hashdd/twitter-hashddbot/
http://tweettioc.com/

Other
Dumping from start to finish:  https://twitter.com/James_inthe_box/status/1187784553940701184
Getting the ursnif goods:  https://twitter.com/James_inthe_box/status/1153778075697631232