How to track the program?

Question

Windows

How to track what data the program collects and where it sends? There is a program, I want to track what it collects, where and how often it sends it, but I don’t know where to dig, well, if the network traffic is wireshark, but I want to know what MB it drags and merges from the registry to track its body movements, are there any tools?

Answer 1

The most ideal option is to send it to hybridanalysis, there you will have detailed information about what merges where.

Answer 2

sysinternals utilities by Mark Russinovich, also on Habré there were articles on investigating bugs using such utilities

Answer 3

I highly recommend Api Monitor and Sandboxie . Both utilities are free. Description of more than 10000 api functions is included in the Api Monitor program by default. For example, you can install hooks on networking functions (I don't remember which ones, see msdn). And as soon as the program sends or receives something to the network, monitor will pause it. Then see what parameters and data are passed to these functions. By the way, all the parameters that are passed to the function can be changed in the api monitor. Article on xakep.ru