I can't see any file-activities in the graph but in Procmon I can. Which executables shall I choose in ProcDOT's options?įor windump choose the according WinDump.exe (under Linux choose the according tcpdump with a fully qualified path, otherwise it won't work).įor the (DOT) executable of the Graphviz-Suite go to the according "bin"-folder and choose dot.exe (or dot under Linux). If you just monitored a running system without invoking a specific process which can be chosen as a "launcher" keep the "launcher" empty, check the "dumb" checkbox, and refresh the graph. Most probably you forgot to choose a "launcher" process. I get a blank (white) screen instead of a graph. Actually the same "unknown format" message the "launcher" button uses if the Procmon file format doesn't match.
However, with build 22 this error message will change to a more precise one. Please follow the instructions in the readme.txt! Most probably you forgot to pre-configure Procmon properly. Please follow the instructions in the readme.txt! ProcDOT whines about a not available PNG file. Tutorial-Video 4: Analysis (Part 2): The Timeline FAQs Most issues can be solved by following the instructions in the readme.txt! ProcDOT whines about an "unknown format" of the used Procmon file. Right double click (double lick again to re-fit and center graph to window) Left double click (double click again to go back to previous scope) select the first relevant (malicious) process (launching process).choose graphing mode (no paths, compressed).CSV which can be easily done via the "Save" menuitem in Procmon. Sad but true, the specs for Procmon's native file-format (.PML) are not (publicly) available. ProcDOT depends on third party software! Please follow the instructions in the included readme.txt to install and configure ProcDOT properly. Join our ProcDOT forum or drop us a line: ProcDOT now has its own dedicated website: Important You've got some feedback (issues, ideas, etc.)? See changelog included in the ZIP archive !forum/procdot Project website of ProcDOT
0 kommentar(er)
