wtrace is an open-source console-based process monitor for Windows. It’s essentially a stripped-down version of Sysinternals Process Monitor which you can run at the command line. The program is entirely portable, with no drivers or Windows services involved. Just unzip the single executable and run it from an elevated command line. Basic usage sounded simple, at least in theory. Run the program from an elevated command line with the name of the process image -- wtrace outlook.exe -- and it displays file creates, reads, writes, closes, thread starts, ALPC and RPC actions (local and remote procedure calls) and more. We…
[Continue Reading]