🧰 Process Monitor

The items that name it 3

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1
  writeup2026-09-28

  Used to detect that the TCP connection to the attacker proxy came from the svchost.exe instance hosting netprofm

• Awesome Malware Analysis
  repo2026-07-31

  Advanced monitoring tool for Windows programs

• Hiding in Plain Sight with App Domain Manager Injection
  writeup2026-02-19

  Observe file access patterns and identify when malicious assemblies are being loaded