Volatility
Regmon
Wed Dec 16 23:37:44 1998


Greetings Dancer,

There's a much simpler solution to this. Choose "Filter", then type your program's handle (in this case CYT) into the "Process Includes" box. Now the only registry acceses that will show are the ones performed by CYT.