Thankfully PM has a range of filters that can include or exclude data from the output. This is due to the fact that hundreds of events can occur per second, and letting malware run for 10-15 minutes will produce hundreds of thousands of events that are logged. You can uninstall Process Monitor from your computer by using the Add/Remove Program feature in the Windows Control Panel.

It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger. With that being said, the output from Process Monitor can be a bit overwhelming (to say the least) if you don’t know how to use it. Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. Plus, all of the output can be exported out to a file for later viewing, which makes life pretty simple. It can be used as a very detailed timeline for malware execution, or set to display the activity associated with a targeted process. Process Monitor is a program that greatly expands the options available on the traditional Windows process monitor. It monitors as much or as little activity as you want. “Proces Monitor is an advanced monitoring tool for Windows that shows real-time file system, registry, and process/thread activity” For anyone performing dynamic (live) analysis of malware, an essential tool to have at hand is Windows Sysinternal’s Process Monitor. So why is this a must for malware analysis? The website describes the tool best:

Process monitor sysinternal