Sysinternals

Process Monitor v4.1 This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds the IPC event class for named pipes and mailslots. ZoomIt 12.3 for macOS This update to ZoomIt for macOS, a screen magnification and annotation tool, introduces DemoMirror for mirroring the screen, a screen region, or a window, onto a second monitor. RDCMan v3.21 This update to RDCMan, a tool for managing and connecting to Remote Desktop sessions, re-enables remote desktop gateway support. ZoomIt v12.21 This update to ZoomIt, a screen magnification and annotation tool, fixes an application hang occurring when recording.

NotMyFault v4.6 This update to NotMyFault, a tool that creates on-demand Windows crashes, hangs, and kernel memory leaks, is now in Rust and has a modern UI. RDCMan v3.20 This update to RDCMan, a tool for managing and connecting to Remote Desktop sessions, adds Azure Virtual Desktop workspace feed, and Microsoft Dev Box support. ZoomIt v12.2 This update to ZoomIt, a screen magnification and annotation tool, introduces DemoMirror for mirroring the screen, a screen region, or a window, onto a second monitor. CoreInfo v4.02 This update to Coreinfo, a tool that reports processor, socket, NUMA memory, and cache topology of a system, as well as processor features supported, improves CPU vendor name detection, and adds Intel LP-E cores support. Process Explorer v17.13 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds core type information for Intel CPUs. Process Monitor v4.05 This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds a new Process Tree PID filtering capability for matching based on any ancestor process ID in the process tree. PsPing v2.13 This update to PsPing, a tool implementing the standard ping functionality, alongside TCP/UDP latency and bandwidth measurements, fixes a series of bugs.

LiveKd v5.65 This update to LiveKd, a utility that allows running the kernel debugger on a live system, protects generated dump files from non-admin readers. ProcDump v12.01 This update to ProcDump, a command-line utility for generating memory dumps from running processes, adds bug fixes. ZoomIt v12.11 This update to ZoomIt, a screen magnification and annotation tool, adds JPEG and WEBP snip support.

Autoruns v14.3 This update to Autoruns, a utility for monitoring startup items, adds bug fixes and fully aligns the command-line autorunsc with the GUI capabilities, including packaged apps support. ZoomIt v12.1 This update to ZoomIt, a screen magnification and annotation tool, adds image backgrounds, webcam background blur and microphone noise cancellation support. Coreinfo v4.01 This update to Coreinfo, a tool that reports processor, socket, NUMA memory, and cache topology of a system, as well as processor features supported, adds support for new processor features. DebugView v5.02 This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, adds Ctrl-Shift-A support for selecting all output, and agent skills support for the CLI utility. LiveKd v5.64 This update to LiveKd, a utility that allows running the kernel debugger on a live system, fixes a debugging privileges issue. ProcDump 3.5.2 for Linux This update to ProcDump for Linux, a tool for capturing process dumps, adds .NET counters and a custom core dumper. Process Monitor v4.04 This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds some bug fixes. Sysmon v15.21 This update to Sysmon, an advanced host security monitoring tool, adds some bug fixes.

Process Monitor v4.03 This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds some bug fixes.

Autoruns v14.2 This update to Autoruns, a utility for monitoring startup items, adds support for Windows packaged apps. ProcDump v12.0 This update to ProcDump, a command-line utility for generating memory dumps from running processes, adds process tree support with -pt. ZoomIt v12.0 ZoomIt, a screen magnification and annotation tool, brings webcam overlay support for video captures and allows appending clips in the video trim editor. DebugView v5.01 This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, reinstates Windows 10 support, enables highlighting on PID, and fixes a series of bugs. NotMyFault v4.5 This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds a new type of crash for Level-0 Hyper-V virtualized machines, and adds a SecureKernel crash. Process Explorer v17.12 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds a "parent PID" column to the main view and fixes a crash on exit. Process Monitor v4.02 This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds Ctrl + PgUp/PgDn for longer scrolling (10 page) in the main list view, shows milliseconds for the times in the Process Tree dialog, and fixes a series of API mismatches. Linux tools Sysinternals EBPF, Sysmon for Linux, Procmon for Linux, ProcDump for Linux, jcd (on Linux), have been updated with support for RHEL10, Debian 13, and Fedora 43.

• Sysmon 1.5.2 for Linux
• Procmon 2.2.1 for Linux
• ProcDump 3.5.1 for Linux
• jcd 1.0.2

Process Explorer v17.11 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, includes stability fixes.

listent 1.0 for macOS listent is a macOS command-line tool to discover and list code signing entitlements for executable binaries. It supports static scanning, real-time process monitoring, and background daemon operation. ZoomIt v11.0 This update to ZoomIt, a screen magnification and annotation tool, adds panorama / scrolling screenshots support, text extraction during snip, break timer improvements, and enables the trimming clip editor for existing .mp4 files. Sysmon v15.2 This update to Sysmon, an advanced host security monitoring tool, improves the handling of the internal events queue, making the service more resilient to dropped events on high system load. DebugView v5.0 This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, improves Windows 11 support and offers a modern UI with a dark theme, and includes performance optimizations. NotMyFault v4.4 This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds secure kernel and hypervisor crash triggers. Procmon 2.2 for Linux Process Monitor for Linux, a convenient and efficient way for developers to trace the syscall activity on the system, updates to dependencies. RAMMap v1.63 This update to RAMMap, an advanced physical memory usage analysis utility for Windows, adds visual feedback to save and load operations.

Process Explorer v17.1 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, fixes a crash generated by processes with long names. SDelete v2.06 This update to SDelete, a command line utility for secure file deletion, adds support for long file paths and restricts MFT optimization to NTFS partitions. Sysmon 1.5.1 for Linux This update to Sysmon for Linux, a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more, fixes a Red Hat Enterprise Linux 9 eBPF program validation bug.

ZoomIt v10.0 This update to ZoomIt, a screen magnification and annotation tool, adds a video clip editor for trimming recordings before saving them and supports recordings with system sounds. Sysmon 1.5 for Linux This update to Sysmon for Linux, a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more, adds EbpfEvent for monitoring Linux EBPF program loading. Sigcheck v2.91 This update to Sigcheck, a command-line utility that shows file version number, timestamp information, and digital signature details, including certificate chains, improves Windows 11 support. RAMMap v1.62 This update to RAMMap, an advanced physical memory usage analysis utility for Windows, fixes a display bug for file streams containing non-printable characters. RDCMan v3.12 This update to RDCMan, a tool for managing and connecting to Remote Desktop sessions, fixes IPv6 parsing, and fixes a double click bug.

Coreinfo v4.0 This update to Coreinfo, a tool that reports processor, socket, NUMA memory, and cache topology of a system, as well as processor features supported, now includes a GUI version and adds checks for features present in modern CPUs. NotMyFault v4.30 This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds Arm64 support and a new crash type for HalTimerWatchdogTriggerSystemReset. Process Explorer v17.09 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, fixes an image type bug, and enables the assemblies tab for .NET processes.

Process Explorer v17.08 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, reenables the Image field in the process Properties dialog.

ZoomIt v9.21 This update to ZoomIt, a screen magnification and annotation tool, fixes several minor bugs.

ZoomIt v9.20 This update to ZoomIt, a screen magnification and annotation tool, can now save screen recordings as either MP4 or GIF. Process Explorer v17.07 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds strings for Arm64 binaries, and fixes a bug that disabled notification area icons. RDCMan v3.11 This update to RDCMan enables Entra ID logins.