apmx_parse
Parse Rohitab API Monitor capture files to extract process information, loaded modules, and API call counts for initial forensic analysis.
Instructions
Parse Rohitab API Monitor capture file (.apmx64/.apmx86). Returns process info (name, PID, path, command line), loaded modules, and API call count. Use this first to understand what's in a capture.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to .apmx64 or .apmx86 capture file |