Fibratus: a tool to capture the most of the Windows kernel activity
github.com