Features

-Dump Process -Crash
- Sort processes by End Time to group WerFault and crashed process directly adjacent to each other.
-Dump Dns
- Made process display non default. If you want to view the processes for each query you can add -ShowProcess to view them as before.
-Dump Memory
- ModuleInfo info of executable is printed when -smi is added. CSV output is also supported
- Print totals for committed , diff and number of processes per file
-Dump File
- Show Total Time in summary which is the sum of Read+Write+Open+Close times. This is also supported in per process summary and detail (-details) mode.
IETWExtract
- Add ComputerName to IETWExtract.ComputerName
- Add Disk layout and partition (e.g. drive letter) information to IETWExtract.Disk.DiskInformation
-Dump Stats
- Add Machine and Disk to console output.
-Extract Memory
- Extract SystemCacheWs, PagedPoolWs, SystemPteWs as synthetic processes with pid 1. These are not real processes.
default.stacktags
- Added Trim Working Set stacktag to identify performance issues due to hard limits on system file cache working set.

Fixes

Exception in ETWProcess when ProcessName was null
Exception during extract: Some files are not using datetime versioning to extract module versions. Ignore these.
-Dump Memory: Dump all processes even when working set did not change.
Extracted memory info is now rounded at x.5 to the next bigger number (MB) which reduces the rounding error.
-Extract CPU: When CPU Sampling without stacks are recorded we did not use CSwitch data for CPU consumption.
This seems to be a setting which is widely used by MS support.
All commands support now -help e.g. -dump cpu -help will print just the CPU help. Before that you needed to add garbage to the command to get the help text.