Questions tagged [sysinternals]

Usually refers to applications from the Sysinternals Suite (eg. Process Explorer, Process Monitor, RAMMap, ...)

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

Is there any native way on windows or using sysinternals to scan what websites a process is accessing?

I am struggling to find a way to scan for websites an specific process on windows 10 os is accessing without having to get a commercial tool or without a full package tracing app like wireshark I was ...
user avatar
  • 457
0 votes
0 answers
33 views

How to determine which PID sends specific DNS requests on Windows?

Is there any way to find out which process (PID) is generating DNS requests on Windows (user computer, win10). I tried some tools from sysinternals (process explorer, tcpview,...) but non on them were ...
user avatar
0 votes
1 answer
10 views

Can you set Process Monitor to filter multiple file types instead of a single file type? Or all sounds?

I'm trying to figure out which programs are making certain sounds and the only tool that I've come across to have that ability is Syinternals Process Monitor. Filters Unfortunately, it doesn't seem to ...
user avatar
0 votes
0 answers
59 views

RUnning psexec as system user returns "access denied"

I am trying to run a program on a remote system, and since I want to peform this action using the shutdown script of my computer, the call to psexec runs as system user. My problem is that I can run ...
user avatar
  • 1,249
0 votes
0 answers
20 views

Can I use ProcessExplorer to trace the parameters of future running process?

I would like be able to trace all calls to MSBuild.exe with its parameters. It seems I should be using sysinternals Process Explorer. I'm lost how I can accomplish this or if I should be doing ...
user avatar
0 votes
1 answer
23 views

How to see the process stack in the Sysinternals Process Explorer from a .net console app?

I am trying to get deeper in the understanding how the OS stacks up the chained function calls. So I created a very simple dotnet console app, see the code below, I call the "Call()" method ...
user avatar
0 votes
0 answers
33 views

How to associate RDG files to the RDC Manager shipped with sysinternals when sysinternals comes from the MS Store?

I installed the sysinternals suite from the Windows store. This includes Microsoft Remote Desktop Manager. However, this setup does not create file associations. How to associate RDG files to this app ...
user avatar
  • 1,840
0 votes
1 answer
80 views

TCPView (Windows) doesn't show any addresses

I'm using TCPView 4.16 for Windows 10 (downloaded from https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview). Up until a few days ago it worked fine, but all of a sudden it simply stopped ...
user avatar
  • 1
0 votes
0 answers
73 views

Psexec64 not working & Error 1231 from 'NET USE \\LOCALHOST\C$'

Whenever I run psexec64 locally, it fails with a "network can't be reached" error. Same goes if I try to use net use, which fails with error 1231. Psexec64.exe -s -i cmd.exe The network ...
user avatar
0 votes
0 answers
20 views

How can I catch a briefly executing process with SysInternals Process Explorer? (or any standard tool)

For example with SysInternals Process Explorer I can briefly see a process popping up, I even see the window on-screen for half a second, but I can't figure out which tool or method to use to catch it ...
user avatar
  • 159
0 votes
1 answer
140 views

RamMap empties Standby Lists but doesn't free them

My problem is: when I use RamMap to empty some standby memory, it gets emptied and zeroed, but the freed memory isn't added to the Free memory counter afterwards. Instead, it keeps contributing to the ...
user avatar
11 votes
1 answer
2k views

Why windows executables show incorrect compiler timestamps?

I have observed that windows executable files show incorrect timestamps when I view them in PE studio. For example this Notepad.exe file shows a compiler timestamp of 0x86FCBD69 (Mon Oct 07 03:45:05 ...
user avatar
  • 113
0 votes
1 answer
644 views

Sysinternal's VMMap is unable to find injected memory

I'm writing a Python script that uses the Windows API to learn process injection. The injection is successful. I can verify that the shellcode is running, and Process Explorer shows the connection: ...
user avatar
0 votes
1 answer
122 views

Different Imphash for same PE file

I am analyzing a windows executable (C:\Windows\System32\xcopy.exe). The Imphash value calculated with Python is different from the one shown with PE studio. How can Imphash for a same file be ...
user avatar
  • 113
1 vote
0 answers
57 views

How to run as admin an .Net exe with PSExec ( doesn't work on some of EXE)

I use PsExec to run some exe with administrators right on a Windows Server 2016. It works. Saddly, i have a .net exe which run not in admin right despite the use of psExec. I think it's due to the exe ...
user avatar
1 vote
1 answer
185 views

Unable to locate the physical disk sector(s) a file occupies

Sysinternals Diskview is producing what seems like an unlikely situation. I have a series of files I know exist on an NTFS filesystem (which is on a spinning disk hard drive), but when I try to use ...
user avatar
  • 31
1 vote
2 answers
316 views

Sysinternals Handles Close Command?

https://docs.microsoft.com/en-us/sysinternals/downloads/handle >>> I downloaded the file on this site. Everything is fine but I cannot do exactly what I want. I explained exactly what I ...
user avatar
0 votes
0 answers
19 views

procmon - reset "relative time"

procmon allows to add column Ralative Time (since the start of profiling). I want to measure distance between recorded events and it would be trivial if I can reset relative time to zero at some ...
user avatar
  • 1,674
1 vote
2 answers
183 views

Why is it that a tool like sysinternals Autoruns might not know the location of a startup?

From the help file for autoruns: Note: before you send e-mail reporting what you believe to be an auto-start location that's overlooked by Autoruns, please make sure that Autoruns doesn't cover it and ...
user avatar
0 votes
1 answer
117 views

How are Windows SysInternal Utilities Licensed? [closed]

Specifically I want to know about SDELETE by Mark Russinovich. I didn't find any license attached, although he holds a Copyright for it.. I want to know because I want to distribute it in my own ...
user avatar
0 votes
1 answer
97 views

How to launch a program on different desktop, using sysinternals desktops

Is there a way to start a program on a different desktop? Say if Desktop 2 is currently displayed, how could I open Notepad on Desktop 4?
user avatar
  • 101
0 votes
0 answers
29 views

Checking all connections on Windows 7

I want to check all outbound/inbound connections when my pc is (apparently) idle and possibly permit/deny selectively each of them as soon as they occur. Unfortunately it seems not possible on Windows ...
user avatar
  • 130
1 vote
0 answers
196 views

Process Monitor: Any way to tell what process is terminating another?

I use Process Monitor from SysInternals to view logs from users' when they're being unable to launch an application. Very often users are running various security software they're not even aware of, ...
user avatar
0 votes
1 answer
25 views

editing sysinternal log to post on forum

I use sysinternal tool procmon https://docs.microsoft.com/en-us/sysinternals/downloads/procmon I want to edit its log because I want to post it online on technical forums for disucssions. I want to ...
user avatar
0 votes
1 answer
92 views

Sysinternals Live unexpectedly slow?

I understand that the live version will inevitably be slower than a local copy. However, considering my system specs and bandwidth, the amount of latency experienced seems far too disproportionate to ...
user avatar
  • 660
1 vote
1 answer
184 views

How to enable "View Source" in Process Monitor?

Sysinternals Process Monitor has a button to "view the source" on a Event Properties > Stack element: It is disabled in my trace. What do I need to enable it?
user avatar
1 vote
1 answer
311 views

Bypassing agreement prompt for DiskUsage.exe?

I am running du.exe on a remote windows machine and do not want to have to access the remote machine's desktop, but the first run of du.exe is requiring an acceptance of the agreement which would ...
user avatar
  • 13
4 votes
0 answers
1k views

High CPU usage from Explorer.exe - Suspecting Dropbox and/or Onedrive shell integration at fault

I'm experiencing high CPU usage from Explorer.exe and I am using SysInternals' Process Explorer to try to diagnose the issue. Frequently I will get a CPU History graph like this (or worse, showing ...
user avatar
  • 641
0 votes
1 answer
53 views

What is corel doing on my udp connections for Chrome?

I have a weird mc.corel.com address lingering in Chrome and some parts of svchost processes, what is going on?
user avatar
0 votes
1 answer
127 views

Cmd instantly closes

So my cmd instantly closes, I tried following this: https://stackoverflow.com/questions/5373137/cmd-exe-closes-immediately-after-calling-win7-64 this kind of solves the problem but it introduces a new ...
user avatar
-1 votes
1 answer
415 views

Alternative WHOIS client for Windows 10?

The de-facto whois client is Whois 1.20 From SysInternals, but it currently tries to contact moniker.com each time you attempt a whois, and now it is running into an endless loop situation.
user avatar
  • 557
1 vote
1 answer
325 views

What determines a DLL's "create time" in the ListDLLs output?

I've run ListDlls on an EXE that I'm unsure should be running no my computer. The dates are all over the place for the DLLs in the output. I'm curious as to how the "create time" field is set.
user avatar
1 vote
0 answers
83 views

In Process Monitor, is it possible to see what data is written/read per entry?

In Process Monitor, is it possible see what data is being read/written to a particular item, be it a file or registry? For example, if a program added "platform=x64" to settings.ini somewhere, Process ...
user avatar
  • 5,465
0 votes
2 answers
830 views

In the output of SysInternals Handle.exe what does RWD stand for?

I'm using handle.exe from SysInternals to grab information about open handles. Running just handle.exe -p cmd to get the handles for cmd.exe, I get the following output. Other output is similar, just ...
user avatar
1 vote
3 answers
4k views

PsExec treats second remote computer in list as a program name

PsExec behaves very strangely when run on a specific server When I use PsExec to run a program on multiple remote machines in most cases, it works perfectly fine. When I run the same command on one ...
user avatar
4 votes
1 answer
571 views

Where does chocolatey install sysinternals?

Chocolatey has a nice sysinternals package, but where does it install to? (by default) https://chocolatey.org/packages/sysinternals
user avatar
  • 2,282
2 votes
1 answer
657 views

How to change "Volume Serial Number" in Windows docker image?

I am trying to change the "Volume Serial Number" of a docker image with Sysinternals VolumeId but I'm getting Error reading drive: The request is not supported. when I run Volumeid64.exe C: 1AAA-111A -...
user avatar
1 vote
1 answer
1k views

System Internals procexp64 wont restore Task Manager

Prior versions of Process Explorer would allow you to toggle on/off the Replace with Task Manager option. However the current version seems not to toggle so well. After turning it on I can no longer ...
user avatar
  • 4,545
49 votes
3 answers
33k views

Restore the original task manager after replacing it with the Sysinternals process explorer

After replacing the default Windows task manager with Sysinternals’ process explorer via the Options → Replace task manager menu, how do you undo that action, i.e. restore the original task manager? I’...
user avatar
  • 1,931
2 votes
1 answer
785 views

Why do programs start working when I open Process Monitor?

I have a script I wrote that creates and writes to a file every 20 or 30 seconds and it has been doing that fine for the past 15 years or so on 5 versions of Windows, but I installed the outstanding ...
user avatar
  • 21
4 votes
1 answer
2k views

How can I run SysInternals ProcMon (or equivalent) inside a docker Windows container?

I'm trying to diagnose an issue where a complicated process does not run inside of my Windows Core container. I really need to figure out why it is failing. If this was a VM, I would just pop up the ...
user avatar
6 votes
3 answers
19k views

Errors starting PsExec to run a program as a local service

When I run the following command from an Administrative Command Prompt: psexec64 -i -u "nt authority\network service" C:\Windows\System32\cmd.exe I'm getting these error messages: Couldn't install ...
user avatar
3 votes
1 answer
566 views

"I/O write" or "Disk write" affects the SSD?

I like to find out which program using mostly my SSD. I'm using Process Hacker (in elevated mode) to get an overview of my SSD usage and find the programs whose using it mostly. To test the ...
user avatar
  • 171
0 votes
0 answers
1k views

Process Explorer: Process Disk: Read/Write bytes not working?

I like to find out which program using mostly my SSD. On Windows 7 x64 machine in Process Explorer (opened as Administrator) double clicking on a process opens up the details of it. On the Disk and ...
user avatar
  • 171
1 vote
0 answers
3k views

Extremely high modified memory usage and pages won't flush

My Lenovo Y50-70 machine suffers of extremely poor performance lately. I'm disturbed by some memory-related issues. The machine has 8gb RAM and the pagefile size is currently 24gb ("Autmomatically ...
user avatar
0 votes
1 answer
614 views

Running Process Monitor causes application to work

This is a longshot, but perhaps someone with knowledge of the internal workings of Sysinternal's Process Monitor may have an idea. Recently we've had a very murky problem at work. We have a software (...
user avatar
  • 95
0 votes
1 answer
1k views

Why does running a specific command remotely over SSH fail?

I am creating two Bash scripts on my Raspberry Pi, which is running the default Debian-based Linux distro: one to sleep my desktop computer, and one to shut it down. The script to shutdown the ...
user avatar
  • 432
2 votes
1 answer
369 views

What is the most practical way of finding out which certificate is the problematic one?

I've been using wsusoffline for quite sometime, but recently, I've had this problem. The program downloads an update but then immediately deletes it producing the following warning in the log: ...
user avatar
1 vote
0 answers
588 views

PSEXEC OpenSCManager fails when execute command for workgroup from domain

I am trying to run sysinternals' PSEXEC from my domain machine to workgroup machine and vice versa: Cmd Line: Psexec \\\MachineName -u "username" -p "password" -i -s -d cmd.exe If I run this ...
user avatar
2 votes
0 answers
332 views

PsGetSID shows two usernames and one SID

We changed the logon name of a person in AD from 'name1' to 'name2'. We had problems with some sql boxes picking up the old 'name2' and using it to authenticate so in tracking down why I ran: ...
user avatar
  • 21