4 ms·
I would suggest to use procmon.exe, all file and registry accesses could have been monitored without any disassembly and the problem could probably have be reso
by jquast 5y ago
I would suggest to use procmon.exe, all file and registry accesses could have been monitored without any disassembly and the problem could probably have be resolved much easier.
- forbiddenlake 5y agoThis is mentioned and used in the article.
- jquast 5y agoSorry my bad it is the very last tool used, which does in fact lead to success, I guess documenting all this other stuff might help somebody somewhere, or at least persuade people to skip the superfluous efforts and just go right to procmon