<Overview>
Starts a program and keeps a record of what it does to the machine.
File reads and writes, registry access, network traffic and DNS lookups are listed with the time they happened.
Behaviour common to malicious programs, such as adding itself to startup or dropping an executable in Temp, is marked and coloured.
If the program starts another program, that one is followed too.
Recording starts before the program does, so its first moves are in the log as well.
Stop ends the program being examined, and every program it started, directly or indirectly.
Programs started by way of Windows itself, such as a service or a scheduled task, can be left behind.
The log can be written out as CSV or JSON, or saved as a session and opened again later.
<System Requirements>
• Windows 7 or later (64-bit)
• No additional runtime or installer is required
• It asks for administrator rights on launch, which is what Windows requires before it will hand over its activity records (ETW)
• DNS lookups are not recorded on Windows 7 and 8, as Windows only began reporting them in 8.1
<Download>
▼ Download (106 KB)
The zip contains the executable, README.txt (English), and README(Japanese).txt.
<Disclaimer>
This tool runs the program for real, so do not run anything harmful on the computer you use every day.
Use a virtual machine, or something else you would not mind losing.
When the record is found to be incomplete, the count and the reason appear on the status bar and in Summary.
Events that could not be taken in, operations whose result never arrived, files that could not be identified, registry keys that could not be resolved and child processes that could not be followed are each counted separately.
The author makes no warranty as to the accuracy or suitability of this program for any particular use.
<Contact / Error Reports>
https://lee22.net/contact.html