Sysinternals Suite

v2024.06Microsoft Sysinternals

The classic Windows internals toolkit. The range ships text-mode clones of Process Explorer, Process Monitor and Autoruns backed by the simulated host's process table, registry hives and startup entries.

Category: Endpoint telemetry & host instrumentation
Package: sysinternals-suite
Runs on: Windows
Commands: procexp, procexp64, procmon, autoruns, autorunsc, handle, tcpview, pslist, psexec

Reads the simulated host's process, registry and autorun state. No real Windows API is called.

Install it

The scripts below install the real Microsoft Sysinternals package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-sysinternals.sh

No Linux build. Run this one on a Windows host in the range.

Windows installer (PowerShell)

Install-sysinternals.ps1

Sysinternals Suite has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

No Linux build. Run this one on a Windows host in the range.

On Windows

Release archive

Unblock the download first
```
Unblock-File .\sysinternals-suite.zip
```
Windows marks anything from the internet; unblock it or the extract fails.

Unpack it under C:\Tools

Expand-Archive .\sysinternals-suite.zip -DestinationPath C:\Tools\sysinternals-suite

Put it on PATH

setx PATH "$env:PATH;C:\Tools\sysinternals-suite"

Check it worked

Confirm it resolves
```
where procexp
```
Check the version
```
procexp --version
```
The range reports 2024.06.

Remove it

Take it off again

Remove-Item -Recurse -Force C:\Tools\sysinternals-suite

Inside the range

Tick it on the launch screen
Under Sysinternals Suite's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
winget install --id sysinternals-suite -e
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Sysinternals Suite

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.