- Sysinternals offers advanced utilities for analyzing processes, files, the Registry, and the network in Windows with much more detail than standard tools.
- Process Explorer and Process Monitor are key to investigating performance, errors, and malware, thanks to their deep view of processes, DLLs, handles, and events.
- Tools such as Autoruns, TcpView, Sysmon, and PsTools complete the ecosystem, allowing control of automatic startups, network connections, and local or remote administration.
- Running via Sysinternals Live and frequent updates make the suite an essential resource for administrators, developers, and advanced users.
If you've been using Windows for a while and find that Task Manager isn't enough to fully understand what's really going on with your system, Sysinternals is exactly what you've been looking for. This suite of advanced Microsoft utilities lets you see, in detail, which processes are running, which files they're accessing, which Registry keys they're modifying, and even which network connections they're opening.
These tools existed long before Microsoft adopted them, and although many go unnoticed, they are a true Swiss Army knife for analyzing Windows processes, detecting errors, and hunting malware . We'll take a detailed look at how to leverage Process Explorer, Process Monitor, and the other process-focused Sysinternals utilities, explained in clear language and with practical examples.
What is Sysinternals and why is it so useful for analyzing processes?
Sysinternals is a project created in 1996 by Mark Russinovich and Bryce Cogswell to host small, advanced diagnostic tools, initially focused on Windows NT, Windows 2000, and Windows XP. The original site was called NTinternals and was designed to show the inner workings of the operating system so that administrators and developers could understand what was happening "under the hood."
Ten years later, in 2006, Microsoft acquired the project and integrated it into its own website: since then, sysinternals.com redirects to an official Microsoft section . Even so, the spirit has remained: small, lightweight, mostly portable utilities (just copy, run, and you're done), which continue to be updated, expanded, and refined frequently.
These tools are primarily designed for system administrators, IT professionals, and developers , but any advanced user can benefit greatly from them. They allow you to understand, configure, and manage very specific aspects of Windows: from what runs at startup to which processes consume CPU, which DLLs are loaded, and which network ports are used.
The complete suite includes over 70 utilities and is also available in the Microsoft Store as Sysinternals Suite . Installing it from the store won't give you a single "app" icon; instead, you'll get a collection of executables and documentation, which you can launch by searching for each tool by name or navigating to its location.
Sysinternals Live: Run tools without installing them
One of the key advantages of this family of utilities is Sysinternals Live , a service that allows you to run the tools directly from the network, without manually downloading and unzipping anything to your disk.
To use it from File Explorer, simply type the tool's path using the Sysinternals Live domain, for example: live.sysinternals.com/<toolname> or the UNC route \\live.sysinternals.com\tools\<toolname>This way, Windows will open the executable directly from the Microsoft share.
If you prefer the console, you can launch any utility with a similar path: \\live.sysinternals.com\tools\<toolname>This saves you from having to manage local versions and ensures you're always using the latest version of each tool.
To explore everything that's available, you can open https://live.sysinternals.com/ in your browser or Windows Explorer , where you'll see the complete directory of Sysinternals Live tools ready to use.
Process Explorer: The “Supercharged Task Manager”
Process Explorer is arguably Sysinternals' best-known tool when it comes to Windows processes . Its purpose is to show, in much greater detail than Task Manager, what the system is running, how processes interact, and what resources they are using at any given time, in order to optimize performance.
The Process Explorer interface is divided into two main sub-windows. At the top, a list of all active processes is always displayed, usually organized in a tree structure to show parent and child processes, along with data such as program description, company, process identifier (PID), CPU usage, memory usage, etc. The names of the user accounts that own each process are also shown.
The lower window can operate in two modes: handles mode and DLL mode. In handles mode, you'll see the handles that the selected process has open (files, registry keys, system objects, etc.). In DLL mode, it displays the dynamic link libraries and memory-mapped files that the process has loaded. This is crucial for locating which file an application is locking or which suspicious module has been injected into a legitimate process.
Process Explorer also includes a powerful search function that lets you locate which process is keeping a particular file or DLL open . You enter the name or part of the name and instantly get a list of the processes involved—very useful when Windows won't let you delete a file "because it's in use" and you want to know who's holding it.
Another strength is digital signature verification . Using the "Verify" option, you can check if the executables and DLLs loaded into memory have a valid signature from their manufacturer. This helps distinguish legitimate processes from potentially manipulated or unsigned binaries, which is very common in malware or older, no-longer-maintained programs.
The tool also uses colors to visually characterize processes : system services, processes within the context of Windows Explorer, packaged applications, etc. A quick glance at the column of names and colors lets you see what each element looks like without needing to delve into too much detail at first.
In addition, Process Explorer offers a timeline view that graphically displays when each process started . In security incident or anomalous behavior analysis, this feature helps pinpoint when suspicious activity began and how it relates to other processes started within the same timeframe.
The utility is ideal for tracking down DLL version issues, handle leaks (handles that are never released), and generally for better understanding how Windows works internally and what your applications actually do.
Process Monitor: real-time X-ray of files, logs, and processes
Process Monitor (Procmon) is another key component of the Sysinternals ecosystem. It's an advanced monitoring tool that displays all file system activity, Windows Registry activity, and running processes or threads in real time.
It combines and surpasses the features of the older Filemon and Regmon utilities, adding a long list of improvements designed for comprehensive traceability without losing any information . Among its most notable features is a highly flexible and non-destructive filtering system: you can apply, adjust, and remove filters on the fly without losing any events that have already been captured.
Each logged event displays comprehensive properties, including session IDs, usernames, process image path , the command line from which it was launched, process and thread IDs, and much more. For each operation, it's possible to capture thread stacks with built-in symbol support, which helps pinpoint the root cause of a given call.
The internal logging architecture is designed to scale very well even under heavy loads: it is capable of handling tens of millions of events and gigabytes of log data without faltering, which is essential when you want to keep capturing information during a full system boot or in the event of an intermittent failure that is difficult to reproduce.
Process Monitor allows you to record activity directly to a file in a native log format that preserves all the details for later loading into another instance of the tool. This is very useful in forensic or technical support environments: you capture the problem on the user's machine and analyze the results later on your own computer.
The interface includes configurable and scrollable columns for virtually any event property. Filters can also be created based on any field, even those not configured as visible columns, offering a huge level of customization to narrow down exactly what you need to see.
Among the auxiliary tools, the process tree stands out , showing the relationship between all the processes present in a trace; the process tooltips and details information, which allow viewing extensive fields in pop-up windows without saturating the main view; and a cancelable log search to locate specific strings without blocking the interface.
Process Monitor also includes a boot time logging mode , capturing operations from the initial stages of Windows startup. For those who troubleshoot boot problems, diagnose application failures , or search for malware, Process Monitor often becomes an indispensable tool in their toolkit.
Process Explorer and Process Monitor in forensic analysis and malware hunting
Sysinternals tools are especially useful when we suspect a system has been compromised and want to find out what processes the malware uses and how they interact with the system . It's not always about gathering evidence for a trial; often we just want to immediately understand what's happening on a machine so we can act quickly.
The first step is usually to ensure you have the Sysinternals suite installed or accessible, either through a local download or by using Sysinternals Live. Once available, you'll find executables like Process Explorer (procexp.exe) and Process Monitor (procmon.exe) in the appropriate folder, ready to launch without complex installations.
With Process Explorer, you can see all active processes and threads, their CPU and memory usage, PID, description, and other associated processes . If you suspect an infection, you'll often see clear signs: processes with strange names, unusual locations, unsigned executables, or processes that are dependent on suspicious parent processes.
In a forensic context, Process Explorer becomes one of Sysinternals' most valuable tools. For example, you can analyze a specific process, such as that of a browser plugin (Flash was once a typical target of attacks), that you suspect has been compromised. By opening its properties, you'll see a panel with numerous sections of information : path to the executable, startup commands, resource consumption, loaded modules, permissions, and so on.
From the permissions tab, you can check who has access to that process . If, in addition to the expected accounts (System, local user, standard services), you see unknown or unusual accounts, it could be a sign of manipulation or malicious persistence.
Another key feature is the Strings tab, which allows you to extract all the ASCII strings embedded in the process . These may include comments left by the developers, file paths, web addresses, commands, error messages, and other data very useful for profiling the behavior of the analyzed binary.
Process Monitor complements this analysis by allowing you to see in detail every operation the process performs on files, the Registry, and the network . You can filter the trace to focus on the suspicious process and observe which keys it touches, which files it reads or writes, and what errors it returns. Often, the combination of both tools provides a clear enough view to identify the attack vector or persistence method of the malware.
Process Explorer in detail: installation, usage and symbols
Installing Process Explorer is straightforward: simply run the procexp.exe file . As a portable utility, it doesn't require an installation wizard and doesn't aggressively modify your system. The built-in help file explains the options and usage modes in considerable detail.
If you encounter doubts or problems with Process Explorer, Microsoft maintains a specific section on its Questions and Answers (Microsoft Q&A) platform dedicated to this tool, where other users and experts share solutions, tips, and real-world experiences with different usage scenarios.
To get the most out of debugging information, Process Explorer can use debug symbols . When you configure the path to DBGHELP.DLL and the symbol server (for example, the Microsoft public server), it's important that the folder containing DBGHELP.DLL also contains SYMSRV.DLL, which is the library that allows access to those servers.
The SymSrv documentation explains in more detail how to configure these symbol paths and how to work with symbol servers. Properly configured symbols greatly improve the quality of call stacks and the internal information displayed about processes and DLLs.
Process Explorer is updated relatively frequently. In recent versions, such as v16.43, it maintains compatibility with Windows 8.1 and later on the client side and Windows Server 2012 and later on the server side. This makes it a versatile tool suitable for mixed environments with different versions of Windows.
Process Monitor in detail: filtering, columns, and usage scenarios
Process Monitor is also distributed as a standalone executable. Once launched, it starts capturing events almost instantly, so it's a good idea to set up filters early to avoid ending up with an unwieldy ocean of data.
Each row in the main view represents an event: what process originated it, at what time, what operation it performed (file reading, Registry writing, process creation, etc.), on what path, what result it returned, and additional details, such as the specific parameters of that call.
The tool displays a wealth of information per event: process name, exact time, full resource path, result, and specific data . This richness allows for diagnosing everything from permission errors to misconfigured paths or misplaced DLLs.
Procmon integrates a series of advanced filters that you can define by virtually any field, combining conditions with logical operators. This makes it possible, for example, to focus solely on access denied errors , single-process write operations, or reads of a specific registry key.
In malware scenarios, Process Monitor helps you see exactly what the suspicious program is doing : where it tries to write, which Registry keys it uses to stay active at startup, which files it downloads or modifies, and what errors it's causing in the system. All of this is logged and can be saved for later analysis or to document a security incident.
As an added bonus, the symbol-supported thread stacks provide context about which specific function of which module originated each event, allowing you to reach a very fine level of detail when investigating the internal behavior of an application or system component.
Other Sysinternals tools related to processes and systems
Although Process Explorer and Process Monitor are the stars for analyzing processes in Windows, the Sysinternals suite includes many other utilities that complement that view and help in diagnostics, security, and performance.
Handle is a command-line handle viewer that lets you list which system files and objects are being used by each process. It's the console version of the handle information you see in Process Explorer, very useful for scripting and automation.
ListDLLs also shows, from the command line, which DLLs each process has loaded, which is useful for detecting injected modules or unexpected libraries within a legitimate executable.
PsList and PsKill , part of the PsTools suite, allow you to list and terminate processes both locally and remotely. Command-line tools like these are essential for administrators working from the console.
Sysmon (System Monitor) is a system service that, once installed, remains active after restarts and is dedicated to monitoring and logging system activity in detail . It logs process creations, network connections, file modifications, inter-process memory access, remote thread creation, and more, all while integrating with Windows event logs.
To view all network port activity, TcpView lists open TCP and UDP connections in real time, indicating local and remote addresses, connection status, and, in modern versions of Windows, the name of the owning process . It's like an enhanced, graphical version of Netstat, excellent for detecting suspicious network activity generated by malware or unauthorized software.
Autoruns and other key utilities of the Sysinternals suite
Although the focus here is on processes, one cannot talk about Sysinternals without mentioning tools that, while not pure process tools, are essential for controlling what runs on Windows and how.
Autoruns is the ultimate resource for reviewing and managing everything that starts automatically with the system or user session. It goes far beyond MSConfig: it displays programs in Startup folders, Run and RunOnce Registry keys, automatic startup services, Explorer shell extensions, toolbars, browser help objects, Winlogon notifications, and much more.
The information is organized into thematic tabs (Office, Printers, Winlogon, etc.), allowing you to see the source of each Autorun entry . Each line includes fields such as the entry name (Autorun Entry), a brief description, the publisher (Publisher), the image path (Image Path), the date and time it was installed (Timestamp), and a VirusTotal scan indicator.
In the interface, pink entries typically correspond to files without a digital signature or with a signature that could not be verified: this could be due to expired certificates, very old programs, corrupted files, or suspicious modifications. Yellow entries indicate files that no longer exist or that the tool cannot access , even though the system continues to attempt to load them at startup. In these cases, it's advisable to carefully review the entry before deleting anything, and as a precaution, it's usually best to uncheck the entry rather than delete it.
Autoruns also allows you to compare captures taken at different times to see what has changed between one analysis and another, which is very useful for detecting new startup entries added by a program or malware.
Other popular Sysinternals tools include AccessEnum (for listing file, folder, and registry key permissions that deviate from their parent folder), BGInfo (which displays technical system data directly on the desktop background), Contig (for defragmenting specific files without touching the entire disk), Desktops (virtual desktops also in older versions of Windows), Disk2vhd (for converting physical disks into VHD files for virtual machines), and ZoomIt , widely used in technical presentations for zooming and drawing on the screen with keyboard shortcuts.
In the area of advanced administration, PsTools offers a suite of command-line utilities for local and remote management: password changes, checking logged-in users, managing processes and services, remote command execution (PsExec), and system shutdown. Many of these tools are essential in corporate environments where numerous computers are managed from the command line.
Recent developments in the Sysinternals ecosystem
Microsoft continues to maintain and expand Sysinternals with regular updates. Recently, significant improvements have been introduced to various tools that directly or indirectly influence process and system analysis.
For example, ZoomIt has reached version 10.0 , adding a video clip editor for trimming recordings before saving and support for capturing system audio. ZoomIt has also been integrated into Microsoft PowerToys, while remaining a standalone utility on Sysinternals and becoming open source.
In the area of monitoring, Sysmon for Linux has continued to evolve, incorporating events such as EbpfEvent to monitor eBPF program loads, extending Sysinternals' focus beyond Windows into Linux environments, something especially interesting for mixed teams.
Other notable updates include Coreinfo with a graphical interface for visualizing CPU topologies, NUMA memory, and processor characteristics; RDCMan with security enhancements and modern Remote Desktop support; and Ctrl2Cap , a tool that helps remap the Caps Lock key to Ctrl in Windows 10 and 11 without the need for additional drivers.
There's even an Azure DevOps extension that integrates Sysinternals tools into build and deployment pipelines, making it easier to troubleshoot build and version issues directly in CI/CD environments, as well as Linux-adapted versions of ProcDump and Sysmon with support for architectures like ARM64.
Taken together, this entire ecosystem means that once you get used to working with Sysinternals, they become inseparable companions to Task Manager and PowerToys , especially if you are an advanced user or manage multiple computers.
The combination of Process Explorer and Process Monitor, along with tools like Autoruns, Sysmon, and TcpView, allows you to go from "something's wrong and I don't know what it is" to having a very precise view of which processes are running, how they interact with Windows, what resources they access, and what traces they leave behind . Understanding and mastering these utilities not only helps you solve specific problems but also improves your ability to optimize services and performance and keep your systems under control on a daily basis.
