The system monitor displays process and thread creation as well as binary image loading. The device monitor allows you to capture communications between applications and device drivers.

MultiMon offers three different types of file monitoring: File API monitoring which monitors file activity from the perspective of the application, file system monitoring which monitors file activity from the perspective of the file system and object monitoring which allows you to view activity on file objects from the perspective of the Windows object manager.

The registry monitor shows registry activity in real time.

As a bonus, MultiMon allows you to monitor clipboard, keyboard and task activities as well.

http://www.resplendence.com/download/mmtri.exe (21-day trial version)

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)