Say for example I'm searching for a malware that writes data, or sends data about my OS to external sources, or writes hidden files or registry entries.

Is there a particular tool that tells me EVERYTHING an installer/executable does? This is regarding the Windows platform.

2 Answers 2


It sounds like the best tool for you might be Process Monitor. It can log all file-system writes, network events, and registry activity:

Process Monitor

If you need to examine the details of the network traffic, Wireshark will let you capture and see all network communications:


These two tools should satisfy your ask for "a particular tool that tells me EVERYTHING an installer/executable does?". If, on the other hand, you need to see everything that an installer/executable could do, then you'd need to use a disassembler like IDA Pro to examine all possible code paths, but note that this is much more time-consuming and challenging than using the other two tools described above.

  • 1
    You should probably add API Monitor to the list.
    – tmr232
    Jan 15, 2016 at 13:54
  • 1
    @tmr232: API Monitor is a fantastic tool, but the signal-to-noise ratio can be rather low relative to the output of Process Monitor. As such, I'd suggest that BlueStarry try Process Monitor first as it sounds like that will meet his or her needs. Jan 15, 2016 at 14:16

You may wish to use a tool called RegShot for monitoring changes in the registry. You would take a snapshot of the registry, and then run the suspicious program, any changes will be highlighted by RegShot in the next snapshot you take - RegShot - Sourceforge

Not the answer you're looking for? Browse other questions tagged or ask your own question.