32-bit
zipdownload.sysinternals.com · publisher domain- File name
- ProcessExplorer.zip
- SHA-256
- 47ff65944e87280a0d40e6eb7a6157f13f46d605df44ff794784b54d56795aa6
Process Explorer
by Sysinternals · Proprietary
100/100how this is calculated
Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
Record
- Latest version
- 17.12
- Release date
- 07 May 2026
- Package identifier
- Microsoft.Sysinternals.ProcessExplorer
- Command
- procexp
Official downloads
These URLs are the ones Sysinternals declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
64-bit
zipdownload.sysinternals.com · publisher domain- File name
- ProcessExplorer.zip
- SHA-256
- 47ff65944e87280a0d40e6eb7a6157f13f46d605df44ff794784b54d56795aa6
ARM64
zipdownload.sysinternals.com · publisher domain- File name
- ProcessExplorer.zip
- SHA-256
- 47ff65944e87280a0d40e6eb7a6157f13f46d605df44ff794784b54d56795aa6
Verify the file you downloaded
Run this against the file on disk. If the output does not match the hash below, the file is not what Sysinternals published. Delete it.
Windows · PowerShell
Get-FileHash "ProcessExplorer.zip" -Algorithm SHA256macOS · Linux
shasum -a 256 "ProcessExplorer.zip"Expected output
47ff65944e87280a0d40e6eb7a6157f13f46d605df44ff794784b54d56795aa6
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
Download Process Explorer for Mac
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
- Version on Homebrew
- 1.0.0
- File name
- procexp.tgz
- Download URL
- https://newosxbook.com/tools/procexp.tgz
- Install with Homebrew
- brew install --cask procexp
How we scored this 100 out of 100
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 3 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | ProprietaryA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Is Process Explorer safe to download?
Yes, in the sense we can actually verify: the installer downloads from sysinternals.com, which is a domain we have tied to Sysinternals.
Every one of the 3 installers on this page comes with the SHA-256 Sysinternals declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Install Process Explorer with winget
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Microsoft.Sysinternals.ProcessExplorer --exactUpgrade later
winget upgrade --id Microsoft.Sysinternals.ProcessExplorerWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
Every version on record1
Every Process Explorer version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
- 17.12
Similar programs we index
Matched on the categories Sysinternals and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
More programs we index
Not related to Process Explorer — just other entries, each with its own official URL and published hash.
- Proton VPNHigh-speed Swiss VPN that safeguards your privacy.
- PuTTYA free implementation of SSH and Telnet for Windows and Unix platforms, along with an xterm terminal emulator.
- PyCharm Community EditionThe Python IDE for Professional Developers
- Python 3.13Python is a programming language that lets you work more quickly and integrate your systems more effectively.