Process Monitor (ProcMon) is a sophisticated system monitoring tool for Windows, developed by Microsoft. It offers real-time insights into system activities, with a particular focus on file system operations, registry modifications, process activities, and network interactions. ProcMon is included in the Sysinternals Suite, a set of advanced system utilities created by Mark Russinovich and Bryce Cogswell.

ProcMon Main Window:

Upon launching Process Monitor, the main interface displays a comprehensive view of system activities. It includes columns for process names, process IDs (PIDs), file paths, and detailed information about each event. This setup provides a clear picture of running processes, their unique identifiers, the files they access, and the actions they perform.

How to Capture the events in procMon?

• Process Monitor automatically starts capturing events as soon as it launches, displaying real-time data in the main window. 

• To stop capturing events, click the magnifying glass icon in the toolbar or select File > Capture Events from the menu to toggle capturing on and off. 

• Once you’ve captured the desired events, go to File > Save to open the Save dialog. Choose your preferred file format (e.g., PML, CSV, XML) and specify a location to save the log file.

Process Tree:

In Process Monitor, the Process Tree offers a hierarchical view of running processes and their parent-child relationships. This feature helps users trace the origin of specific activities by showing which processes spawned others. The Process Tree also allows users to identify suspicious or unwanted processes by examining their lineage.

Process Tree Lists:

Boot Logging:

Enables capturing events from the beginning of the boot process, which is useful for diagnosing issues that arise during system startup.

Command Line Arguments: