Autoruns vs OpenProcMon

Autoruns shows programs and drivers configured to run during Windows boot, login, or when certain built-in Windows applications start. It reports startup items from locations such as the Startup folder, Registry keys, Explorer extensions, services, scheduled tasks, and Winlogon entries. Users can hide signed Microsoft entries to focus on third-party items, inspect startup images configured for other accounts, and disable an entry or delete its configuration. Scan options include signature verification and VirusTotal hash checks; submitting files not previously scanned requires the upload option, and VirusTotal features require accepting its terms. The download includes Autorunsc, a command-line version that can output CSV or tab-delimited data, verify signatures, and scan an offline Windows system. The Autoruns and Autorunsc download is listed as 3 MB, and Microsoft offers a Sysinternals Live option. Autoruns costs nothing, with no limit on installation or use on devices owned or supported by the user, but no redistribution license. Microsoft says Sysinternals tools are provided as is without official support and points users to a community forum.

OpenProcMon is a free, open-source process monitor for 64-bit Windows. It tracks process, file system, registry, and network activity in real time, with filters for process name, PID, operation, path, result, or category. Its interface includes a process tree, activity summaries, and call-stack views with per-frame module resolution. The tool reads and writes Sysinternals Process Monitor .PML logs, including logs made with the original Process Monitor. Developers can use its Rust SDK to connect to the driver, choose monitored activity, set filters, and consume parsed events programmatically. For AI-assisted capture and analysis, the procmon-cli MCP server operates over stdio and has setup instructions for clients including Claude Code, Claude Desktop, Codex, and Cursor. Capture tools can export filtered results as PML, CSV, or XML. The v0.5.0 release offers a Windows x64 ZIP with the GUI, CLI/MCP server, console example, skill, and guides. Live capture needs Administrator privileges to load the kernel driver; analyzing an existing .PML file does not. The project is MIT-licensed and its Rust rewrite is described as under active development.