What is Procmon?

Process Monitor (Procmon) is a Windows Sysinternals tool that monitors real-time file system, registry, and process/thread activity. It combines the features of two legacy Sysinternals tools, Filemon and Regmon, adding an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. It is commonly used for troubleshooting system and application issues, analyzing malware activity, and understanding how applications interact with the operating system.