Windows application forensics — see exactly what a program does to your machine and to the network.
Warning
Authorized use only. Captured sessions can contain passwords, tokens, cookies, full URLs, request and response bodies, file contents, usernames, and other sensitive data. Use this only on systems you own or are explicitly authorized to test. Never commit a session to a public repository. See SECURITY.md.
Install monitors show you what changed. Network sniffers show you what was sent. CaYaTrace joins the two into a single causal chain, so you can follow one thread from a double-click all the way to an HTTPS request:
setup.exe
├─ msiexec.exe
│ ├─ FILE CREATE
│ │ └─ %PROGRAMFILES%\Example\example.exe
│ ├─ REGISTRY SET
│ │ └─ HKLM\...\Uninstall\Example::DisplayName
│ │ from: (not present)
│ │ to: Example 2.1
│ └─ SERVICE CREATE
│ └─ ExampleService
│
└─ example.exe
├─ FILE CREATE
│ └─ %APPDATA%\Example\config.json
├─ DNS
│ └─ api.example.com
└─ HTTP(S)
└─ POST https://api.example.com/v3/register
├─ Request metadata
├─ Response metadata
└─ 1.7 KB sent / 4.2 KB received
Then it turns that recording into a portable removal package you can carry to a machine that has never run CaYaTrace and clean it there — with every item re-verified against that machine before anything is touched.
A program that installs a local helper and then coordinates with it over 127.0.0.1 is
invisible to ordinary capture. An established loopback connection is handled by a fastpath
inside the Windows stack and never becomes a packet on any adapter — measured with the
packet monitor Windows ships, told to capture every component: 5,276 events, not one of them
loopback. So every tool can tell you that 4,096 bytes went to 127.0.0.1, and none of them
can tell you what the bytes were.
Turning on Capture local conversations reads them, in both directions, with contents, over IPv4 and IPv6 loopback. It needs Npcap — the free packet driver Wireshark uses, whose loopback adapter works through the Windows Filtering Platform and so sits above the fastpath. Two things worth knowing before enabling it: the recording then contains local traffic from every process on the machine rather than only the subject's, and Unix-domain sockets, named pipes and loopback TLS are still recorded as sizes or ciphertext rather than contents. The session says which of those applied.
An analysis machine is deliberately clean, so this is usually not installed on the machines that most need it. Ticking the option on a machine without it explains what is missing, links to its authors, shows the address as selectable text for a virtual machine with no browser, and — if you have already copied the installer in — offers to start it, after checking who signed it. CaYaTrace does not bundle Npcap and never installs it in the background: its free licence permits neither, and the installer's own screens are where its terms are accepted.
- Correct attribution over more events. PIDs get recycled; file and registry events carry pointers, not names. Getting these wrong produces a confident, wrong tree. See the correlation layer.
- Honest about what it missed. ETW drops events silently under load, which makes a session look cleaner than reality. Every session reports its own data quality.
- No kernel driver of its own. No install, no reboot, no test-signing mode, nothing left behind. The one exception is opt-in and somebody else's: reading local conversations needs Npcap's driver, which is why that is a checkbox and not a default. Why, and what it costs.
- Removal that cannot brick the machine. Non-overridable deny list, fingerprint verification, quarantine instead of delete, rollback journal, dry run by default.
This is an early release. What is real today versus designed is tracked honestly:
| Area | Status |
|---|---|
| Process / thread / module tracing, causal tree | ✅ working |
| File and registry tracing with name resolution | ✅ working |
| Registry before → after value transitions | ✅ working |
| Before/after system inventories + diff | ✅ working |
| Network flows with process attribution (kernel) | ✅ working |
| DNS queries and answers, attributed to the requesting process | ✅ working |
| TLS handshake metadata (Schannel) | ✅ working |
| Full URLs from WinINet / WinHTTP applications | ✅ working |
| Session storage, JSONL journal, data-quality reporting | ✅ working |
Removal planner, .ctpkg packages, remediation runner |
✅ working |
CLI (trace, report, remediate, compare, explain, agent) |
✅ working |
| Workbench UI (WebView2 + CaYaDev theme) | ✅ working |
| Packet capture via Pktmon, correlated to processes | ✅ working |
| Loopback capture: what programs on this machine say to each other, with contents (opt-in, needs Npcap) | ✅ working |
| Intercepting proxy for full request bodies (opt-in) | ✅ working |
Multi-VM comparison (compare) with measured path templating |
✅ working |
| Fleet transport: paired, encrypted host ↔ agent channel | ✅ working |
| Risk scoring with visible reasons | ✅ working |
| Ollama integration with model capability testing | ✅ working |
| VirusTotal reputation (hash lookup, never uploads) | ✅ working |
| HTML / JSON / CSV / text export with category and depth selection | ✅ working |
| Turkish and English interface, following the system language | ✅ working |
| Persistence: every mechanism a program uses to run again, with what it configured | ✅ working |
| Process timeline: what ran, for how long, under which parent, and what it touched | ✅ working |
| Conversation contents reassembled from packets, split by local network vs internet | ✅ working |
| Ask the session: answers computed from the recording; a model may compare and rank, never invent | ✅ working |
| Chat that follows a conversation, narrows to the thing you named, and builds one grounded command | ✅ working |
| Web lookups from the chat for an unfamiliar name, off unless switched on | ✅ working |
| Machine changes undone on the next launch even when the session was killed | ✅ working |
| Removal progress, self-protection disarming, and quarantine keep/restore/delete | ✅ working |
| Fleet: join from the window, per-machine live view, remote stop of a process or service | ✅ working |
| Conversations between processes on this machine, with the program at each end | ✅ working |
Everything below is driven from one window. Nothing here needs the command line.
Findings lead, because they answer the question an analyst opens a session with. Every one carries the rules that produced it, and a registry change shows what the value was before and what it became.
 Capture — launch a program, attach to a running one, or watch the whole machine. |
 Causal tree — process → child → module → file → registry → service → connection → request. |
 Network — which process asked for which URL, with status and bytes. |
 Remediation — review what would be removed before anything is touched. |
 Assistant — a local model, measured against known answers before it is believed. |
 Fleet — record on several machines; an agent is inert until you approve it. |
The interface follows the system language. Same session, Turkish Windows:
Download CaYaTrace.exe from Releases. It is
portable — one file, no installer, no service, nothing written outside its own folder and the
session directory you choose.
Run it with no arguments and the workbench opens. Choose a program on the Capture tab, press record, use the program the way a user would, then press stop. Everything else — findings, the causal tree, network activity, export, removal — is in that window.
For scripting and sandbox automation, every capability is also a verb:
CaYaTrace trace --target "C:\Downloads\setup.exe" --duration 120Render what it found, as a tree, as JSON, as a spreadsheet, or as a report you can email:
CaYaTrace report --session .\sessions --format html --out report.htmlBuild a removal package from the recording:
CaYaTrace report --session .\sessions --export-package Example.ctpkgPreview the removal on any machine (nothing is changed without --apply):
CaYaTrace remediate --package Example.ctpkgRecord the same program on two VMs, then compare — the parts that recur are its real behaviour, and the paths that differ become measured patterns the package carries:
CaYaTrace compare .\vm-a .\vm-b --export-package Example.ctpkgRank and explain a session, optionally with a local model:
CaYaTrace explain --session .\sessions --check-modelsRun CaYaTrace help for every option.
Kernel tracing needs an elevated prompt. Without it CaYaTrace still records before/after system inventories, and tells you clearly what it skipped rather than pretending the program did nothing.
- Windows 10 (1809+) or Windows 11, x64 or ARM64
- Administrator rights for kernel tracing — everything else works unelevated
- WebView2 runtime for the workbench UI (preinstalled on Windows 11; the CLI does not need it)
- Npcap only for capturing local conversations. Everything else works without it, and the session says so plainly when it is asked for and missing
Requires the .NET 8 SDK.
git clone https://github.com/CaYatur/CaYaTrace.git
cd CaYaTrace
dotnet test
dotnet publish src/CaYaTrace.App -c Release -r win-x64 -o distTrimming is disabled deliberately — here is why.
The interface follows the Windows display language: Turkish on a Turkish system, English
everywhere else. Override it for one run with --lang en or --lang tr, for a shell with
CAYATRACE_LANGUAGE, or permanently with the EN/TR switch in the workbench.
An exported HTML report carries both languages and its own switch, so a colleague reads it in theirs rather than in the language of whoever recorded it.
Operation names in the tree (FILE CREATE, REGISTRY SET) stay in English in every
language, so reports remain diffable and searchable across locales.
| Architecture | How the engine works, and the limits it has |
| Package format | The .ctpkg removal package |
| Roadmap | What is planned, in what order |
| Security | Handling captured evidence; reporting vulnerabilities |
| Contributing |
CaYa Network Forensic Observer — the network-only predecessor. CaYaTrace supersedes it by adding system-change tracing, causal correlation, and remediation.