procmon.bat

procmon.bat

REM Ugly file-based process monitor script. Non-PowerShell in case blocked

@echo off

:loop

del file1.txt 2> nul
del file2.txt 2> nul

for /f "usebackq skip=1 tokens=* delims= " %%i in (`wmic path win32_process get commandline ^| findstr /r /v "[^\ ]"`) do echo %%i >> file1.txt

ping -n 1 127.0.0.1 >nul

for /f "usebackq skip=1 tokens=* delims= " %%i in (`wmic path win32_process get commandline ^| findstr /r /v "[^\ ]"`) do echo %%i >> file2.txt

fc file1.txt file2.txt | findstr /r "[abcdefghijklmnopqrstuvwxyz]" | findstr /v "ECHO" | findstr /v "*****" | findstr /v "Comparing" | findstr /v "wmic" | findstr /v "FC:"

goto loop