progmboy

Capture and analyze Windows process / file / registry / network activity with OpenProcMon (procmon-cli). Use when investigating what a program does — files it writes, registry keys it touches, network it makes, its process tree and call stacks — or when analyzing a Procmon-compatible .PML capture. The model: a capture writes a .PML; every analysis reads one.