==========================================
  JoyShine Forensics AppTracer
==========================================

Starts a program and keeps a record of what it does to the machine.

File reads and writes, registry access, network traffic and DNS lookups are listed with the time they happened.
Behaviour common to malicious programs, such as adding itself to startup or dropping an executable in Temp, is marked and coloured.
If the program starts another program, that one is followed too.

------------------------------------------
  System Requirements
------------------------------------------

Windows 7 or later (64-bit).
No additional runtime or installer is required.

Put JoyShine Forensics AppTracer.exe in any folder and it runs.

It asks for administrator rights on launch.
That is what Windows requires before it will hand over its activity records (ETW).

------------------------------------------
  Usage
------------------------------------------

1. Choose the EXE you want to look into

2. Click Start Monitoring

   Recording starts before the program does, so its first moves are in the log as well.

3. Narrow the list

   Clearing a category checkbox drops that kind of row.
   Typing in Filter leaves only the rows containing that text.
   Ticking Suspicious leaves only the rows that were marked.

4. Click Stop

   The program being examined is ended, and so is every program it started, directly or indirectly.
   Programs started by way of Windows itself, such as a service or a scheduled task, can be left behind.

The File menu writes the log out as CSV or JSON.
Saved as a session, it can be opened again later and read the same way.

------------------------------------------
  Notes
------------------------------------------

This tool runs the program for real, so do not run anything harmful on the computer you use every day.
Use a virtual machine, or something else you would not mind losing.

When the record is found to be incomplete, the count and the reason appear on the status bar and in Summary.
Events that could not be taken in, operations whose result never arrived, files that could not be identified, registry keys that could not be resolved and child processes that could not be followed are each counted separately.

DNS lookups are not recorded on Windows 7 and 8.
Windows only began reporting them in 8.1.

------------------------------------------
  Freeware
------------------------------------------

https://lee22.net/

------------------------------------------
  Contact / Bug Reports
------------------------------------------

https://lee22.net/contact.html

------------------------------------------
