NoVirusThanks WOW64 SysCall Monitor

Made for computer administrators who are continuously looking for software solutions to simplify their work, WOW64 SysCall Monitor is a tool that can be used to spawn a process and keep an eye out for all system calls made by it. This also includes NT-prefixed system APIs from the System Service Descriptor Table (SSDT) and System Service Descriptor Table Shadow (GUI/Graphics services).

Wrapped in a portable package, the utility can be launched by double-clicking the .exe file right after unzipping the downloaded archive. Thanks to this, it can be saved to a removable storage unit and effortlessly deployed on any PC to investigate process-related issues.

The main app window has a plain look and is split into two tabs: main and events. The main area shows all NT services currently being monitored by the software application. They are autodetected by default. After opening the right-click menu, you can ask it to select or unselect all NT services, in case you want to block them.

Before starting the monitoring job, you can pick the .exe of a program you want to analyze. Events can be inspected in the second tab and saved to log files for a closer look at the API name, timestamp, calling process, and thread ID.