Taking a Process Monitor trace on Windows

To collect process information on the endpoint using Process Monitor (ProcMon), it is essential to execute the program with elevated privileges.

一款64位Exe程序动态追踪执行流程以及保存信息的工具. Contribute to Wker666/exe-analyzer development by creating an account on GitHub.

If you enable Audit process tracking then Windows will track process-related events such as the creation of a process. Be warned though that this also audits a lot of other process events that you aren't going to want.

I want to understand and track what an executable program/application/process is doing my computer. How can I find all the files (like ouput files, log files, etc.) that it has opened or is accessing when it is running?

如何在 Windows 10 中使用 Windows 搜尋搜尋 exe 檔案？ 如果您想在 Windows 10 中使用 Windows 搜尋搜尋 exe 文件，可以依照下列步驟操作：

In this article we will show you how to use Process Monitor (ProcMon) to track file and registry changes

How can you find the exe file of a program on Windows? This post gives four ways for you to locate the file easily.