這是一個高級的Windows監(jiān)視工具,不但可以監(jiān)視進程/線程,還可以關注到文件系統(tǒng),注冊表的變化.它包含2個Sysinternals遺留組件:Filemon 和 Regmon,并添加了大量功能,有興趣的可以去再關注一下.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit