Skip to content

v0.2.1

Choose a tag to compare

View all tags
@JameZUK JameZUK released this 23 Jun 20:13
· 23 commits to procmon_parser since this release
v0.2.1
e933c4c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • get_process_lifetime returned create_timestamp: null for processes that started during the capture. Procmon records a process's own start as a Process Start event (with that PID), while Process Create is logged by the parent (with the parent's PID); matching only Process Create against the requested PID never found the process's own creation. The tool now considers both operations and uses the earliest, so a process's own Process Start is used when present. (#14)

Full changelog: CHANGELOG.md

Assets 2
Loading