SIDE BAR: Process Hacker may be used as an alternative. This application will be used to identify the processes that are spawned by detonated malicious code and provide the ability to kill the malicious process once identified. Process Explorer will be used to monitor the process tree of all applications that are run on the system. Process Explorer is similar to the Windows Task Manager, but there is more functionality that can be useful to a malware analyst.

Process Explorer is the next monitoring application that should be initiated at this time.

The start the application logging again, the short cut keys are Ctrl-X. The application will need to be initiated again just prior to the launching of the malware. This will disconnect the ETW and Process Monitor for the time being. At this point, the analyst should pause the logging by the use of the short cut keys, Ctrl + E. Process Monitor will continue to run and log the running processes on the system. HP recommends that you specify processors for the OSS Monitor that are not used by the FSCK utility or any name servers. HP strongly recommends that OSSMON not be licensed because only SUPER.SUPER should start, manage, or stop the OSS monitor process. It provides a set of SPI error messages specific to the OSS environment that are returned to the OSS Monitor. When OSS is installed, the OSS Product Module for SCF is also installed in $SYSTEM.SYSTEM.

SCF communicates with OSSMON via the Subsystem Programmatic Interface (SPI). Put procedures in place to ensure that the OSS Monitor is started with the correct process name and owner during system startup. The OSS monitor process name must be $ZPMON. Put procedures in place to ensure that the OSS Monitor is started with the correct process name and owner. The OSS Monitor terminates immediately if $ZPMON is already running or is given a different process name. In Securing HP NonStop Servers in an Open Systems World, 2006 BP-FILE-OSSMON-01

Process monitor for windows 7 32 bit