Parent process

Child process

sysmon.exe executes as a process with the local user's privileges usually within the context of Windows Explorer. It adds run once key to the current user's profile so that the file will execute the next time the user logs into Windows (it will delete the entry after it runs once). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This particular version is usually found on Windows 7 Home Premium (6.1.7601.65536).

CPU
Total CPU:	0.00006084%	0.028634%
Kernel CPU:	0.00001965%	0.013761%
User CPU:	0.00004119%	0.014873%
Kernel CPU time:	15,642,298,271 ms/min	100,923,805ms/min
CPU cycles:	32,824,503/sec	17,470,203/sec
Memory
Private memory:	14.63 MB	21.59 MB
Private (maximum):	11.59 MB
Private (minimum):	4.31 MB
Non-paged memory:	14.63 MB	21.59 MB
Virtual memory:	130.26 MB	140.96 MB
Virtual memory (peak):	231.75 MB	169.69 MB
Working set:	5.79 MB	18.61 MB
Working set (peak):	16.16 MB	37.95 MB
Page faults:	17,244,144/min	2,039/min
I/O
I/O read transfer:	15 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	53 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	6	12
Handles:	172	600
GUI GDI count:	6	103
GUI GDI peak:	6	142
GUI USER count:	1	49
GUI USER peak:	2	71