Sysinternals Site Discussion

Handle v4.22, NotMyFault v4.20, Process Explorer v16.25, Sysmon v10.1

Mark Russinovich — Sat, 15 Jun 2019 19:27:45 GMT

Handle v4.22 This release of Handle fixes a race condition in the driver that could lead to a crash. Notmyfault v4.20 Notmyfaultc now includes a flag that makes it wait until an event named Notmyfault is signaled before proceeding to crash or leak. Process Explorer v16.25 This update to Process Explorer fixes a potential buffer overflow when processing abnormally large environment variable blocks. Sysmon v10.01 This update to Sysmon fixes a memory leak in image load events that v10.0 introduced.

Sysmon v10.0, Autoruns v13.95, VMMap v3.26

Mark Russinovich — Wed, 12 Jun 2019 03:29:59 GMT

Sysmon 10.0 This release of Sysmon adds DNS query logging, reports OriginalFileName in process create and load image events, adds ImageName to named pipe events, logs pico process creates and terminates, and fixes several bugs. Autoruns 13.95 This Autoruns update adds support for user Shell folders redirections. VMMap 3.26 This update to VMMap, a tool for looking at the virtual and physical memory usage of a process, fixes a bug in 64-bit CLR heap reporting.

Sysmon v9.0, Autoruns v13.94

Mark Russinovich — Tue, 19 Feb 2019 20:47:31 GMT

Sysmon 9.0 Sysmon v9.0 introduces rule groups that enable the specification of AND or OR matching logic across a set of rules. It also fixes a memory leak in signature verification. Autoruns 13.94 This Autoruns update fixes a bug that prevented the correct display of the target of image hosts such as svchost.exe, rundll32.exe, and cmd.exe.

Autoruns v13.93, Handle v4.21, Process Explorer v16.22, SDelete v2.02, Sigcheck v2.71, Sysmon v8.02 and VMMap v3.25

Mark Russinovich — Sun, 09 Dec 2018 22:58:42 GMT

Autoruns 13.93 This Autoruns update fixes a bug that prevented UserInitMprLogonScript from being scanned and by-default enables HCKU scanning for the console version. Handle 4.21 This Handle release fixes a race condition that could cause a bluescreen. ProcessExplorer 16.22 This Process Explorer release fixes a race condition that could cause a bluescreen. Sdelete 2.02 SDelete now includes a progress filter that reports progress for the disk cleaning phase that purges MFT resident files. Sigcheck 2.71 This release fixes a crash when attempting to scan small files (< 512 bytes) and resolves issue with incorrect timestamp being reported. Sysmon 8.2 This Sysmon release fixes several filtering bugs, resolves a handle leak and high CPU usage for certain filters when on Windows 7 and Windows Server 2008, and fixes a bug that could cause the service process to crash. VMMap 3.25 This VMMap update fixes a bug that prevented profiling a 32-bit application on a 64-bit OS.

Sigcheck 2.70, BgInfo v4.26, and VMMap v3.22

Mark Russinovich — Sun, 21 Oct 2018 13:08:26 GMT

Sigcheck v2.70 Windows WinVerifyTrust function reports signed MSI files that have malware appended to them as signed, so Sigcheck now indicates when appended content is present. BgInfo v4.26 BgInfo now honors AppLocker scripting policy. VMMap v3.22 This release of VMMap fixes bugs that excluded copy-on-write pages from the private bytes total and that double counted the contribution of page table entries (PTEs).

Sysmon v8.0, Autoruns v13.90

Mark Russinovich — Thu, 05 Jul 2018 23:33:03 GMT

Sysmon v8.0 This update to Sysmon adds rule tagging, which results in tags appearing in event log entries they generate. It also greatly expands the command-line length logged, fixes a GUID printing bug for parent process GUIDs, and prints friendly registry path names for rename operations. Autoruns 13.90 Autoruns, a comprehensive Windows autostart entry point (ASEP) manager, now includes Runonce\*\Depend keys and GPO logon and logoff locations, as well as fixes a bug in WMI path parsing.

RAMMap v1.51

Mark Russinovich — Fri, 01 Jun 2018 13:25:44 GMT

RAMMap v1.51 This update to RAMMap fixes an incompatibility with the latest version of Windows 10.

Sysmon v7.03

Mark Russinovich — Mon, 14 May 2018 17:05:24 GMT

Sysmon v7.03 This update to Sysmon fixes a service executable crash that could result from long file names, and does not hash files larger than 2GB to avoid causing performance issues with SQL Server's large alternate data streams it places on database files.

Sysmon v7.02

Mark Russinovich — Mon, 30 Apr 2018 04:12:50 GMT

Sysmon v7.02 This update to Sysmon, an advanced security logging service, fixes memory leaks in its thread and process tracking callbacks.

Process Monitor v3.50, Autoruns v13.82, Du v1.61, SDelete v2.01

Mark Russinovich — Sat, 17 Feb 2018 15:28:17 GMT

Process Monitor v3.50 Process Monitor now includes a /runtime switch to control headless capture duration, correctly shows picoprocesses, displays details for file system APIs introduced in Windows 10, and includes numerous minor improvements and bug fixes. Autoruns v13.82 This Autoruns release shows Onenote addins and fixes several bugs. Du v1.61 This update to Disk Usage (Du) handles paths greater than MAX_PATH (260 characters) in length. SDelete v2.01 SDelete v2.01 fixes a bug that could cause it to hang with the progress indicator at 100%.