sysmon.exe vs sysmon64.exe

Gary Portnoy 0

I'd like to once and for all understand the difference between the 3 sysmon executables contained in sysmon.zip (sysmon.exe, sysmon64.exe and sysmon64a.exe).

At one point I believed that sysmon64 was the Itanium (ia64) version and that running the plain old sysmon.exe installer automatically chose either the x32 or the x64 build and correctly installed the appropriate image. This is confirmed by checking to see that sysmon is running in 64bit mode after install using sysmon.exe. But I see lots of people on this forum running sysmon64.exe directly to install, so now I am not so sure.

Aniket Chauhan 0 Reputation points

2024-09-28T12:40:08.2+00:00

sysmon.exe

This is the main installer that automatically detects whether your system is 32-bit or 64-bit and installs the right version. It's the one most people use because it handles everything for you.

sysmon64.exe

This is specifically for 64-bit systems. If you're sure your machine is 64-bit, you can run this directly to skip the auto-detection.

sysmon64a.exe

You likely won’t ever need this unless you're dealing with legacy hardware.

So, typically, you’ll just use sysmon.exe, but some people prefer using sysmon64.exe directly to make sure the 64-bit version gets installed.

1 answer

JAMES GILLESPIE 5 Reputation points

2024-09-23T02:30:18.6833333+00:00

sysmon64a.exe is for the 64-bit ARM architecture, I think sysmon.exe has support for both x86 and x64, and of course sysmon64.exe is just for x64.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

sysmon.exe vs sysmon64.exe

1 answer

Your answer