Process Monitor v3.82, TCPView v4.12, Process Explorer v16.42 and Sysmon v13.21

[Alex_Mihaiuc]

Process Monitor v3.82

This update to Process Monitor fixes "go to event" from context menu and introduces some UI improvements for the dark theme.

TCPView v4.12

This update to TCPView fixes a bug where columns would be drawn twice.

Process Explorer v16.42

This update to Process Explorer fixes a bug with signature checks.

Sysmon v13.21

This update to Sysmon fixes a rare crash on process startup on x86 systems.

[Timothy_McGahan]

When can we expect fixes for sysmon "and" / "or" filtering bug and the EID 13 "Details" bug?

https://docs.microsoft.com/en-us/answers/questions/401499/sysmon-possible-andor-in-rulegroup-issue.h...
https://docs.microsoft.com/en-us/answers/questions/332062/sysmon-help-im-unable-to-filter-on-eid-13-...

Thanks, Team!

[Alex_Mihaiuc]

Hey Timothy,

should have been fixed in the past release, v13.20, already. v13.21 further improves on the events with multiple ids under the same name (Pipe, Registry, WMI) so please, let us know if you're still getting unexpected results with your setup.

[Alex_O]

Since the update, I cannot set Process Monitor to run on startup.

Getting the following error:

Process explorer shows no errors.

[gigym]

Can you make Process Explorer Disk History (also Network History) Tray Icon tooltip show the usage rate?

[Alex_O]

Whaddayknow, that fixed it.

[MysticFoxDE]

Hi Alex,

Hi Mark,

i would like to ask you the following things.

1. Why do the information regarding the system load caused by "Context Switches" in the Process Explorer sometimes deviate very seriously from the values,
that I get to see through the performance monitor?

2. It used to be called that a system load of more than 2000 "Context Switches/s" is already to be regarded as critical.
However, I see much higher values ​​with current systems.
At what value does the load from "context switches" become critical in newer systems?

Many thanks and best regards from Germany

Alex