Software Update: Sysinternals Suite 2017-09-11

Microsoft has released a new version of the Sysinternals Suite, with the date as the version number. This package is a collection of useful tools for managing systems and obtaining comprehensive information about the computer. In this way, all kinds of problems can be detected and solved.

The individual tools are being developed by Mark Russinovich and Bryce Cogswell, initially for Sysinternals and since 2006 for Microsoft. Some examples are Process Explorer, Bginfo, contig and disk mon. In total it concerns a collection of 79 different tools. By the way, the latest versions of the individual programs can also be here are being found. Since the previous edition, the following parts of the Suite have been updated:

Sysmon v6.1
This update to Sysmon, a background monitor that records activity to the event log for use in security incident detection and forensics, adds monitoring of WMI filters and consumers, an autostart mechanism commonly used by malware, and fixes a bug in image load filtering.

Process Monitor v3.4
Process Monitor, a file system registry, process and network real-time monitor, now includes a /runtime switch for terminating monitoring after a specified amount of time, when in hexadecimal mode shows process tree process IDs in hexadecimal, and fixes a bug in automated boot log conversion.

Autoruns v13.8
This release of Autoruns, a utility for viewing and managing autostart execution points (ASEPs), adds additional autostart entry points, has asynchronous file saving, fixes a bug parsing 32-bit paths on 64-bit Windows, shows the display name for drivers and services, and fixes a bug in offline Virus Total scanning.

ProcDump v9.0
This major update to ProcDump, a utility that enables process dump capture based on a variety of triggers, introduces the ability to take capture multiple dumps sizes. This is particularly useful when capturing crash dumps of applications susceptible to termination due to unresponsiveness (eg IIS Ping killing w3wp.exe). This release also adds support for an associated Kernel Dump of the process that includes the kernel stacks of the process.