wtrace

wtrace is a formidable system and process tracing and analysis tool. Available for Windows OS only, the tool is as simple as it gets in terms of execution and portability.

wtrace is free of cost, open-source, and mainly written in C# and F#. The developer did an excellent job at offering a non-install, portable digital asset that you can use on different Windows systems to run detailed analyses with filtered information and options to redirect outputs to a different location/process.

The application can run in different modes. Preferable, you would open it using a command-line tool initiated with administrator privileges. Also, if you access the tool with no parameters or passed arguments, you risk initiating a full system scan accidentally, which can take a long time to finish.

That is why, first things first, you can run the 'wtrace.exe' command followed by '--help.' As such, you will see the available options and filter the output with chosen parameters, or simply go for the type of analysis you are interested in conducting.

Although a super-useful application, wtrace might feel like an overwhelming environment for inexperienced users and less tech-knowledgeable individuals. Why? Because the program outputs, in great detail, information about complicated processes that run in the background, apps' calls, Remote Procedure Calls with local and, possibly, remote, sub-routine calls, etc.

As such, wtrace will output valuable information, filtered data (if you know how to narrow down results), and network activity logs. Last but not least, due to the complexity of information it displays and the summary section with a process-tree display, you can see an in-depth overview of your machine's activity, identify friction points or possible threats, and if less tech-savvy, even learn more about kernel-level processes and their hierarchies or concurrent execution modes.