Sysinternals Blog articles

Autoruns, ProcDump, ZoomIt, DebugView, NotMyFault, ProcExp, Procmon, and Linux tools

Alex_Mihaiuc — Thu, 07 May 2026 19:11:06 GMT

This update to Autoruns, a utility for monitoring startup items, adds support for Windows packaged apps.

This update to ProcDump, a command-line utility for generating memory dumps from running processes, adds process tree support with -pt.

ZoomIt v12.0

ZoomIt, a screen magnification and annotation tool, brings webcam overlay support for video captures and allows appending clips in the video trim editor.

DebugView v5.01

This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, reinstates Windows 10 support, enables highlighting on PID, and fixes a series of bugs.

NotMyFault v4.5

This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds a new type of crash for Level-0 Hyper-V virtualized machines, and adds a SecureKernel crash.

Process Explorer v17.12

This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds a "parent PID" column to the main view and fixes a crash on exit.

Process Monitor v4.02

This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds Ctrl + PgUp/PgDn for longer scrolling (10 page) in the main list view, shows milliseconds for the times in the Process Tree dialog, and fixes a series of API mismatches.

Linux tools

Sysinternals EBPF, Sysmon for Linux, Procmon for Linux, ProcDump for Linux, jcd (on Linux), have been updated with support for RHEL10, Debian 13, and Fedora 43.

Process Explorer v17.11

Alex_Mihaiuc — Thu, 09 Apr 2026 16:27:39 GMT

Process Explorer v17.11

This update to Process Explorer, an advanced process, DLL, and handle viewing utility, includes stability fixes.

listent for macOS, ZoomIt, Sysmon, DebugView, NotMyFault, Procmon for Linux, and RAMMap

Alex_Mihaiuc — Thu, 26 Mar 2026 21:02:20 GMT

listent 1.0 for macOS

listent is a macOS command-line tool to discover and list code signing entitlements for executable binaries. It supports static scanning, real-time process monitoring, and background daemon operation.

ZoomIt v11.0

This update to ZoomIt, a screen magnification and annotation tool, adds panorama / scrolling screenshots support, text extraction during snip, break timer improvements, and enables the trimming clip editor for existing .mp4 files.

Sysmon v15.2

This update to Sysmon, an advanced host security monitoring tool, improves the handling of the internal events queue, making the service more resilient to dropped events on high system load.

DebugView v5.0

This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, improves Windows 11 support and offers a modern UI with a dark theme, and includes performance optimizations.

NotMyFault v4.4

This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds secure kernel and hypervisor crash triggers.

Procmon 2.2 for Linux

Process Monitor for Linux, a convenient and efficient way for developers to trace the syscall activity on the system, updates to dependencies.

RAMMap v1.63

This update to RAMMap, an advanced physical memory usage analysis utility for Windows, adds visual feedback to save and load operations.

Process Explorer v17.1, SDelete v2.06, and Sysmon 1.5.1 for Linux

Alex_Mihaiuc — Thu, 05 Mar 2026 20:10:35 GMT

Process Explorer v17.1

This update to Process Explorer, an advanced process, DLL, and handle viewing utility, fixes a crash generated by processes with long names.

SDelete v2.06

This update to SDelete, a command line utility for secure file deletion, adds support for long file paths and restricts MFT optimization to NTFS partitions.

Sysmon 1.5.1 for Linux

This update to Sysmon for Linux, a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more, fixes a Red Hat Enterprise Linux 9 eBPF program validation bug.

ZoomIt v10.0, Sysmon 1.5 for Linux, Sigcheck v2.91, RAMMap v1.62, and RDCMan v3.12

Alex_Mihaiuc — Fri, 06 Feb 2026 16:35:59 GMT

ZoomIt v10.0

This update to ZoomIt, a screen magnification and annotation tool, adds a video clip editor for trimming recordings before saving them and supports recordings with system sounds.

Sysmon 1.5 for Linux

This update to Sysmon for Linux, a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more, adds EbpfEvent for monitoring Linux EBPF program loading.

Sigcheck v2.91

This update to Sigcheck, a command-line utility that shows file version number, timestamp information, and digital signature details, including certificate chains, improves Windows 11 support.

RAMMap v1.62

This update to RAMMap, an advanced physical memory usage analysis utility for Windows, fixes a display bug for file streams containing non-printable characters.

RDCMan v3.12

This update to RDCMan, a tool for managing and connecting to Remote Desktop sessions, fixes IPv6 parsing, and fixes a double click bug.

Coreinfo v4.0, NotMyFault v4.30, and Process Explorer v17.09

Alex_Mihaiuc — Wed, 17 Dec 2025 00:52:52 GMT

Coreinfo v4.0

This update to Coreinfo, a tool that reports processor, socket, NUMA memory, and cache topology of a system, as well as processor features supported, now includes a GUI version and adds checks for features present in modern CPUs.

NotMyFault v4.30

This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds Arm64 support and a new crash type for HalTimerWatchdogTriggerSystemReset.

Process Explorer v17.09

This update to Process Explorer, an advanced process, DLL, and handle viewing utility, fixes an image type bug, and enables the assemblies tab for .NET processes.

Process Explorer v17.08

Alex_Mihaiuc — Thu, 20 Nov 2025 20:27:54 GMT

Process Explorer v17.08

This update to Process Explorer, an advanced process, DLL, and handle viewing utility, reenables the Image field in the process Properties dialog.

ZoomIt v9.21

Alex_Mihaiuc — Mon, 17 Nov 2025 23:18:44 GMT

ZoomIt v9.21

This update to ZoomIt, a screen magnification and annotation tool, fixes several minor bugs.

ProcDump v11.1

Alex_Mihaiuc — Thu, 13 Nov 2025 21:12:02 GMT

ProcDump v11.1

This update to ProcDump, a command-line utility for generating memory dumps from running processes, fixes several minor bugs.

ZoomIt v9.20, Process Explorer v17.07, and RDCMan v3.11

Alex_Mihaiuc — Tue, 11 Nov 2025 20:48:11 GMT

ZoomIt v9.20

This update to ZoomIt, a screen magnification and annotation tool, can now save screen recordings as either MP4 or GIF.

Process Explorer v17.07

This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds strings for Arm64 binaries, and fixes a bug that disabled notification area icons.

RDCMan v3.11

This update to RDCMan enables Entra ID logins.

ZoomIt v9.10, ProcDump 3.5 for Linux, and jcd 1.0.1

Alex_Mihaiuc — Mon, 13 Oct 2025 16:42:41 GMT

ZoomIt v9.10

ZoomIt, a screen zooming, recording and annotation utility, adds image smoothing for higher-quality visuals.

ProcDump 3.5 for Linux

This update to ProcDump for Linux, a tool for capturing process dumps, enables resource tracking without a trigger.

jcd 1.0.1 for Linux and Mac

This update to jcd fixes a bug that caused the terminal to hang on CTRL-C.

jcd 1.0 for Linux and Mac, and ZoomIt v9.01

Alex_Mihaiuc — Wed, 17 Sep 2025 20:04:20 GMT

jcd 1.0 for Linux and Mac

jcd (jump change directory) is a Sysinternals command-line tool that provides quick directory navigation with substring matching and smart selection for both Linux and macOS.

ZoomIt v9.01

This update to ZoomIt fixes a regression that made the current drawing disappear after snip, reenables mouse click for drawing dots in draw mode, and fixes a bug with consecutive record activations.

Process Monitor 2.1 for Linux, Sysmon 1.4 for Linux, and SysinternalsEBPF 1.5

Alex_Mihaiuc — Tue, 08 Jul 2025 22:01:53 GMT

Procmon 2.1 for Linux

Sysmon 1.4 for Linux

SysinternalsEBPF 1.5

This release includes Azure Linux 3.0 support across Procmon for Linux, Sysmon for Linux and SysinternalsEBPF, expanding compatibility with the latest version of Microsoft’s Linux distribution.

Sysmon 1.3.7 for Linux

Alex_Mihaiuc — Wed, 21 May 2025 14:25:14 GMT

Sysmon 1.3.7 for Linux

Sysmon 1.3.7 for Linux fixes a compatibility issue with Debian 11 and adds configuration file hashes to configuration change events.

RDCMan v3.0 and Sysmon 1.3.6 for Linux

Alex_Mihaiuc — Tue, 06 May 2025 10:35:56 GMT

RDCMan v3.0

This update to RDCMan, a tool for managing and connecting to Remote Desktop sessions, implements Windows 11 Terminal Services client features, and adds a series of security and quality of life improvements, like seamless session resizing, keyboard navigation, IPv6 support, and modern cryptography.

Sysmon 1.3.6 for Linux

Sysmon 1.3.6 for Linux adds support for kernel 6.11 and newer.

Troubleshooting Azure DevOps Pipelines with Sysinternals: Introducing the ProcDump Task

Alex_Mihaiuc — Thu, 20 Mar 2025 17:12:21 GMT

Sysinternals Azure DevOps Extension

The Sysinternals ADO Task extension brings the power of Sysinternals tools directly into your Azure DevOps pipelines, enabling you to troubleshoot build and release issues.

For more information, please see the Medium article.

ProcDump 3.4.1 for Linux and Sysmon 1.3.5 for Linux

Alex_Mihaiuc — Tue, 18 Mar 2025 13:40:28 GMT

ProcDump 3.4.1 for Linux

This update to ProcDump for Linux removes the ':' separator for the date/time section of the generated core dump filename, aligning across operating systems.

Sysmon 1.3.5 for Linux

This update to Sysmon for Linux fixes the upgrade path to make sure the previous configuration is restored during the upgrade.

Ctrl2Cap v3.0 and BgInfo v4.33

Alex_Mihaiuc — Thu, 13 Feb 2025 19:36:16 GMT

Ctrl2Cap v3.0

Ctrl2Cap, a tool to help remap the Caps Lock key to Ctrl, has been updated to run on Windows 10 and 11, and not require a driver.

BgInfo v4.33

This update to BgInfo fixes two crashes, and adds text for Windows 11 and Windows Server 2025.

ZoomIt in PowerToys v0.88, ProcDump 3.4 for Linux, and Sysmon 1.3.4 for Linux

Alex_Mihaiuc — Wed, 29 Jan 2025 18:25:35 GMT

ZoomIt in PowerToys v0.88

ZoomIt is now part of Microsoft PowerToys and open source. ZoomIt will continue being available from Sysinternals, as a stand-alone tool.

ProcDump 3.4 for Linux

ProcDump for Linux, a convenient way for developers to generate core dumps, now includes ARM64 support.

Sysmon 1.3.4 for Linux

This update to Sysmon for Linux fixes two memory leaks.

ZoomIt v9.0

Alex_Mihaiuc — Mon, 16 Dec 2024 21:14:37 GMT

ZoomIt v9.0

This update to ZoomIt, a screen magnification and annotation tool, adds LiveDraw to LiveZoom, enables ZoomIt drawing and annotation on top of live windows and the desktop.