UPFLOWEDKnow what just called out — before you can prove it's there.
Upflowed watches every process on your machine for outbound connections and scores what's worth a second look — in plain, checkable reasons, not a black-box verdict.
Every score, spelled out.
- Four legible signals, added up in front of you — a signature Windows doesn't trust, a common staging location, a connection with no DNS lookup first, an uncommon port. No hidden model, nothing to just trust.
- Signatures are verified, not assumed. The check asks Windows for its actual trust verdict rather than settling for "a certificate exists" — and when a binary is signed, the alert tells you who signed it.
- Read the reasons, not a verdict. Each one is written in plain English so you can judge it yourself — and disagree with it, if you know better.
Doesn't cry wolf at Windows itself.
Windows Defender deliberately hardens its own engine against inspection — the same protection that makes it trustworthy also makes it unreadable to a naive scanner. Upflowed treats "I can't verify this" as its own honest state rather than a guess dressed up as a verdict, and holds that line everywhere it applies: a process shielded by Windows, one that exits before it can be inspected, an address that can't be read from the event. Missing evidence never becomes evidence.
Dial it up — never hides something worse.
- A minimum, not an exact match. Filter to High and Critical still shows through — you can never accidentally filter out the worst thing on your machine.
- Search, direction, and a hide-local toggle on the full connection log, live — filtering only changes what's shown, capture never stops underneath.
One click from flagged to checked.
- Every destination is a live link to AbuseIPDB's community abuse reports — no copy-pasting an IP into a new tab mid-panic.
- Trust it once, it stays trusted — mark a process reviewed and it stops re-alerting, persisted across restarts.
- Autosaved every two minutes and exportable as JSON — a crash mid-scan doesn't cost you the session.
Built to be trusted itself.
Local by design
Everything Upflowed sees — every connection, every score — stays on your machine. Nothing is uploaded, no account, no cloud dashboard watching back.
Quiet until it matters
Minimizes to the tray and keeps watching — a sound only plays for a genuinely Critical finding. Close the window without losing the watch by accident.
Fixed by watching it get things wrong.
Every accuracy fix below came from real use, not guesswork — the kind of thing that only shows up once the tool is actually pointed at a real machine.
Flagged Windows Defender's own engine as Critical — now recognized as a protected process, not evidence of tampering.
Flagged ordinary per-user installs (browsers, VS Code) just for not living in Program Files — now only flags actual staging locations like Temp and Downloads.
Re-alerted on the same chatty connection every few seconds — now cools down to once per five minutes per destination.
Not Task Manager. Not Wireshark. Not your antivirus.
Numbers, not names.
Task Manager tells you a process is using disk or network. It doesn't say who it's talking to or whether that's worth a second look. Upflowed adds the part that's actually missing: the why.
Triage, not raw feed.
Sysinternals-grade tools are built for someone who already knows what they're hunting for, in raw packets and events. Upflowed does the triage for you, into a short, prioritized, explained list.
Behavior, not signatures.
Antivirus tells you about threats it already recognizes. Upflowed shows you live behavior regardless of whether anything has a name for it yet — for the moment AV says clean and something still feels wrong.
Get Upflowed.
Free for Windows. Requires administrator — the same access ETW capture always needs.
No installer — unzip and run. .NET is bundled, so nothing else to install.
Verify your copy (SHA-256):
5cce5d511a259fa71f24b1e8f50aab9738ed68ecd35f17793221974c3d06158c
(.sha256)
Built while waiting for a scan to finish.
A disk pinned at 100% and a multi-day antivirus sweep is a bad combination for trust. Upflowed is the tool that existed to watch while the wait dragged on — simple enough to read at a glance, honest enough to say when it doesn't know.