The two tools were combined to create Process Monitor. RegMon and its sister application Filemon were primarily created by Mark Russinovich and Bryce Cogswell, employed by NuMega Technologies and later SysInternals prior SysInternals being bought out by Microsoft in 2006. In addition it shows how applications use files and DLLs, detects some critical errors in system files and more. It also allows for filtering on specific keys, processes, process IDs, and values. Process Monitor can be used to detect failed attempts to read and write registry keys.

Process Monitor monitors and records all actions attempted against the Microsoft Windows Registry. It combines two older tools, FileMon and RegMon and is used in system administration, computer forensics, and application debugging. The tool monitors and displays in real-time all file system activity on a Microsoft Windows or Unix-like operating system. Process Monitor is a tool from Windows Sysinternals, part of the Microsoft TechNet website.

Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit./ April 28, 2021 23 months ago ( ) (Linux version) It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. Windows 8.1, Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022

Process monitor sysinternals download