# Process Monitor Application: Microsoft Corporation Also called procmon, procmon64, sysinternals process monitor Microsoft Corporation, System A file, registry, and process trace from Sysinternals. The 64-bit process is Procmon64.exe. The log grows fast. It is not Process Explorer. ## What you need to know Process Monitor is a trace log. Process Explorer is a live tree. Sysinternals Process Monitor records file, registry, and process events. Get it from Microsoft Learn. Filter first. The log grows fast. procexp64.exe is the other Sysinternals window. - **What is it?**: A file, registry, and process tracer **Same as Process Explorer?**: No. Explorer is a live tree **Does the log grow?**: Yes. Filter first Feex says If the question is "who wrote this file ten seconds ago", I would start Process Monitor with a filter, then reproduce. I would not leave it running all day. The log grows fast. ## What is Process Monitor? Process Monitor records a timeline of file, registry, network, and process events. Procmon64.exe is the logger. Process Explorer is procexp64.exe, a live tree without this boot-to-now log. ## If you have never used it If you need a log of file, registry, and process events, Process Monitor is the Sysinternals tracer. Download it from Microsoft Learn. The log grows fast, so set a filter before you reproduce the bug. It is not Process Explorer, which is a live tree, and it is not Resource Monitor. ## What is it used for? **Trace which process touches a file** Reproduce the action with a filter on the path. Process Explorer shows the handle now. This tool shows the history. **Trace registry writes** Find which app changed a key. That is Procmon, not Task Manager Startup and not Autoruns. **Boot logging (advanced)** Options can log during startup. The PML file gets large. Turn it off after the capture. ## Who is it for? - People hunting an access-denied or a leftover writer - Admins who already tried Process Explorer's handle search - Anyone who should filter first so the log does not eat the disk ## Current status Process Monitor (2006) is a current system activity tracer from Microsoft Corporation. The vendor still points Windows users at https://learn.microsoft.com/sysinternals/downloads/procmon. ## How old is it? Process Monitor shipped in 2006 as the merge of Filemon and Regmon. Process Explorer is older (1997). Microsoft still hosts both. A Filemon-only guide is stale. ## Versions Major channels first. Exact build numbers are not all verified here. Procmon64.exe Sysinternals Suite zip ## System requirements Values follow the publisher's public guidance. Workload still changes the real need. ### Minimum | Operating system | A current supported Windows 10 or Windows 11 release, per Microsoft Sysinternals | | ---------------- | -------------------------------------------------------------------------------- | | RAM | Enough for Windows plus this app. Heavy projects want more. | ## Resource profile - **CPU demand**: Rises with event rate **Disk demand**: The log grows fast without a filter ## Installed processes These executables belong to this product when it is installed. | Procmon64.exe | Trace window | | ------------- | ------------------------------------- | | Procmon.exe | Launcher that starts the 64-bit build | ## Startup components Procmon should not stay on at logon unless you enabled boot logging on purpose. Turn that off after the test. ## File locations | Typical install | Wherever you unpacked Sysinternals | | --------------- | ---------------------------------- | ## File formats PML, CSV ## Common problems ### The log fills the disk Set a filter, drop unused event classes, or use /BackingFile on a large volume. Process Explorer does not write this PML. ### Capture without a filter You will drown in System and Explorer noise. Filter on the process name or path before you click the bug. ## Getting unstuck ### Download Procmon from Microsoft Learn, not a random procmon.exe The Sysinternals zip is signed. Process Explorer is the live tree if you did not need a log. ### Filter > Process Name or Path before you reproduce That is how Procmon stays usable. Autoruns is the logon list, not this timeline. ### File > Save a PML, then File > Backing Files if the capture must be huge Default paging can still grow. Stop the capture when you have the event. ## Alternatives Process Explorer for a live look. Autoruns for logon hooks. Resource Monitor for a simpler disk and network glance. ## Official help and downloads Start with the vendor. Random exe sites are not a support channel. | Download | [learn.microsoft.com/sysinternals/downloads/procmon ](https://learn.microsoft.com/sysinternals/downloads/procmon)Official installer or vendor page | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | Help | [learn.microsoft.com/sysinternals/ ](https://learn.microsoft.com/sysinternals/)Vendor support | | Official site | [learn.microsoft.com/sysinternals/downloads/procmon ](https://learn.microsoft.com/sysinternals/downloads/procmon)Start here, not a random exe host | ## Related hardware A fast disk helps when the PML is large. The tool traces software activity, not a GPU bench. ## Technical details Technical details Vendor version numbers change. This article does not pin a build. ## Related These entities connect to this article. Type is shown on every link. [Autoruns: Application](https://feex.it/wiki/software/autoruns)[Process Explorer: Application](https://feex.it/wiki/software/process-explorer)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager) ## Sources and verification Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research). - [Process Monitor official site ](https://learn.microsoft.com/sysinternals/downloads/procmon)· Vendor product page - [Process Monitor help ](https://learn.microsoft.com/sysinternals/)· Vendor support - [Process Monitor ](https://learn.microsoft.com/sysinternals/downloads/procmon)· Microsoft documentation - [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark. ## Was this article useful? A yes or no is enough. Pick a reason if you want, or add a short note. Quick facts The short identity of this page. Specs, sources, and the full story stay in the article. - **Developer**: Microsoft Corporation **Category**: System activity tracer **Process**: Procmon64.exe **License**: Freeware from Microsoft Sysinternals **First released**: 2006 **Official site**: [learn.microsoft.com/sysinternals/procmon](https://learn.microsoft.com/sysinternals/downloads/procmon) **Mapped by Feex**: Seen on Windows PCs in Foxhole Feex Reviewed: Last verified August 2026 --- Source: [Canonical Feex Wiki page](https://feex.it/wiki/software/process-monitor/) [Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)