# Windows Sysinternals Toolkit Walkthrough

#### **Date:** June 12th 2025 **Category:** Windows 11 Projects

---

### Tools Installed

Installed via Chocolatey:

```powershell
choco install sysinternals -y --ignore-checksums
```

Install location:  
`C:\ProgramData\chocolatey\lib\sysinternals\tools`

Command-line access enabled for:

```powershell
procexp
autoruns
procmon
tcpview
```

🔗 Official Microsoft page:  
[https://learn.microsoft.com/sysinternals](https://learn.microsoft.com/sysinternals)

---

## 1. Process Explorer

- **Launched** with `procexp`
- Enabled **VirusTotal integration**:
    
    
    - `Options > VirusTotal.com > Check VirusTotal.com`
- Investigated:
    
    
    - `PowerPanel Personal.exe` (flagged 1/72 — confirmed false positive)
- Verified digital signatures via:
    
    
    - Right-click process → Properties → `Verified:` field
- Used **Lower Pane View** for:
    
    
    - **DLLs** and **Handle usage**

---

## 2. Autoruns

- Launched with `autoruns`
- Configured:
    
    
    - `Options > Hide Microsoft Entries`
    - `Options > Scan Options > Submit Unknown Images`
- Focused on reviewing:
    
    
    - **Logon**, **Scheduled Tasks**, **Drivers**, **Services**
- Checked VirusTotal flags and verified digital signatures
- Disabled or marked suspicious unsigned entries

---

## 3. Process Monitor (Procmon)

- Launched with `procmon`
- Paused default capture: `Ctrl + E`
- Applied filters for:
    
    
    - Specific processes (e.g., `notepad.exe`)
    - Registry and file system operations
- Resumed capture for real-time inspection
- Saved capture via `File > Save > .PML`

---

## 4. TCPView – Active Network Monitoring

### Tool Summary:

- Launched with: `tcpview`
- Displays:
    
    
    - All active TCP/UDP connections
    - Local and remote addresses
    - Process ownership
    - Packet counts and traffic volume

### Observations:

<table id="bkmrk-process-remote-host%2F"><thead><tr><th>Process</th><th>Remote Host/Service</th><th>Notes</th></tr></thead><tbody><tr><td>`firefox.exe`</td><td>`google.com` (via `142.250.x.x`)</td><td>Normal browser activity</td></tr><tr><td>`steam.exe`</td><td>`valve.net`, `akamai.net`, `u2-puls.tech`</td><td>Related to Steam/Valve CDN</td></tr><tr><td>`PowerPanel`</td><td>Internal `kubernetes.docker.internal`</td><td>Local/VM bridge — normal</td></tr><tr><td>`syncthing.exe`</td><td>`u2-puls.tech` / Docker bridges</td><td>Syncthing sync traffic — expected</td></tr></tbody></table>

---

### WHOIS Lookup: `akamaitechnologies.com`

TCPView revealed connections to domains like `akamaistream.net`, a known CDN subdomain.

WHOIS record for `akamaitechnologies.com`:

<table id="bkmrk-field-value-domain-a"><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td>**Domain**</td><td>akamaitechnologies.com</td></tr><tr><td>**Registrar**</td><td>MarkMonitor Inc.</td></tr><tr><td>**Created**</td><td>August 18, 1998</td></tr><tr><td>**Updated**</td><td>July 16, 2024</td></tr><tr><td>**Expires**</td><td>August 17, 2025</td></tr><tr><td>**DNS**</td><td>`AX0.AKAMAISTREAM.NET`, `NS2-32.AKAMAISTREAM.NET`, etc.</td></tr><tr><td>**Status**</td><td>Protected (delete/transfer/update disabled)</td></tr><tr><td>**Registrar Abuse**</td><td><abusecomplaints@markmonitor.com></td></tr><tr><td>**Official Whois**</td><td>[https://www.icann.org/wicf/](https://www.icann.org/wicf/)</td></tr></tbody></table>

🔗 Akamai Official Site: [https://www.akamai.com](https://www.akamai.com)

### Conclusion:

- Akamai is a globally trusted **CDN and security platform** used by Steam, Microsoft, Apple, and others.
- Connections to `akamaistream.net` and related domains in TCPView are **expected** and **not malicious**.
- WHOIS verified the legitimacy and ownership of the Akamai domains.

---

## 5. PowerShell Signature Verification

Command used:

```powershell
Get-AuthenticodeSignature "C:\Path\To\File.exe"
```

Example:

```powershell
Get-AuthenticodeSignature "C:\ProgramData\chocolatey\lib\sysinternals\tools\procexp.exe"
```

Reviewed:

- `Status` field = `Valid`
- `SignerCertificate.Subject` = Trusted vendor (e.g., Microsoft Corporation)

There are tons of other tools for system analysis as well.