Live CPU graph with per-logical-CPU meters
Memory graph and live network throughput graph
Disk usage table with used/free/total values
System panel with OS, machine name, uptime, AC/battery status
Sortable process list with CPU, memory, threads, PID and executable path details
Optional parent/child process tree with parent PID, handle count, priority and start time
Process filtering and guarded process kill confirmation
JSON snapshot export from the live view
CSV export of the current filtered process list
Copy the selected executable path to the Windows clipboard
Session network totals and memory commit/available statistics
Dedicated USB page for connected/installed USB devices and installed USB drivers
Guarded USB device enable/disable actions through Windows PnP
Dedicated services page with service state, start mode, PID and path details
Guarded service start, stop and restart actions
Service dependency details for selected services
Network page with active TCP/UDP endpoints and owning processes
Startup page with registry startup commands and logon/boot scheduled tasks
Eventlog page with recent Windows errors and warnings
System drivers page with guarded driver start/stop actions
Security page for Defender, firewall, latest hotfix, reboot status, GPU and thermal data
Process priority changes for the selected process
Live action/error/export log pinned to the bottom of the terminal
Health score from CPU, RAM, disk pressure, eventlog, Defender, firewall and pending reboot state
Task Scheduler page with guarded task enable/disable/start actions
Firewall rules page with guarded rule enable/disable actions
Local users/groups page with administrator membership and last logon
Per-process CPU/RAM mini-graphs in the selected process detail panel
Process tree kill, process suspend and process resume actions
Per-process network connection counts in process details
MandyTop start splash in transgender colors
MandyTop ASCII art in transgender colors on wide terminals
Fast live loop: heavy Windows inventories are cached, loaded in the background, and refreshed per page instead of blocking CPU/RAM/process updates
Scriptable --json, --once, --version and --help modes

Run

dotnet run --project .\MandyTop.csproj

Or build a release executable:

dotnet publish .\MandyTop.csproj -c Release -o .\publish
.\publish\MandyTop.exe

If Windows blocks loading the separate MandyTop.dll, build the single-file release:

dotnet publish .\MandyTop.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:EnableCompressionInSingleFile=true -o .\publish-v0.7-single
.\publish-v0.7-single\MandyTop.exe

A tested single-file build is included at:

.\release\MandyTop.exe

Keys

q / Esc: quit
h / F1: help
Space: pause
1: monitor/process page
2: USB devices/drivers page
3: services page
4: network connections page
5: startup entries page
6: eventlog page
7: system drivers page
8: security/updates/firewall/hardware page
9: Task Scheduler page
F9: firewall rules page
F10: local users/groups page
/ / f: edit the current page filter
0: clear the current page filter
s: save current snapshot as JSON
+ / -: change update interval
Up / Down: move selection
PageUp / PageDown: move faster
Home / End: select first/last item

Monitor Page

Tab: cycle process sort column
r: reverse process sort
t: toggle the parent/child process tree
Backspace: edit filter text while filtering
p: arm priority change to AboveNormal
n: arm priority change to Normal
b: arm kill for the selected process tree
z: arm suspend for the selected process
u: arm resume for the selected process
c: copy the selected executable path
e: export visible processes as CSV
x / Delete: arm kill for selected process
Enter: confirm a pending kill

USB Page

d / x / Delete: arm disable for selected USB device
a: arm enable for selected USB device
Enter: confirm a pending USB action
c: copy the selected USB InstanceId
e: export visible USB devices and installed USB drivers as CSV
r: refresh USB inventory

Services Page

o / x / Delete: arm stop for selected service
r: arm restart for selected service
a: arm start for selected service
Enter: confirm a pending service action
c: copy the selected service name
e: export visible services as CSV
Tab: refresh service inventory

Network Page

x / Delete: arm kill for the owning process
c: copy selected connection details
e: export visible connections as CSV
r: refresh network inventory

Startup Page

c: copy selected startup command
e: export visible startup entries as CSV
r: refresh startup inventory

Eventlog Page

c: copy selected event
e: export visible events as CSV
r: refresh event inventory

Drivers Page

o / x / Delete: arm stop for selected driver
a: arm start for selected driver
c: copy selected driver name
e: export visible drivers as CSV
r: refresh driver inventory

Security Page

c: copy security summary
e: export security summary as CSV
r: refresh security inventory

Task Scheduler Page

x: arm start for selected scheduled task
a: arm enable for selected scheduled task
d / Delete: arm disable for selected scheduled task
c: copy selected task path/name
e: export visible tasks as CSV
r: refresh task inventory

Firewall Page

a: arm enable for selected firewall rule
d / x / Delete: arm disable for selected firewall rule
c: copy selected rule name
e: export visible firewall rules as CSV
r: refresh firewall inventory

Users / Groups Page

c: copy selected user/group details
e: export visible users/groups as CSV
r: refresh users/groups inventory

USB disable/enable, process priority changes, process suspend/resume, driver start/stop, scheduled task changes, firewall changes and many service actions require an elevated Windows Terminal. If Windows denies the operation, MandyTop keeps running and shows the error in the status bar and live log.

Per-process network traffic byte rates are not exposed by the built-in Windows APIs used here without a heavier ETW collector. MandyTop currently aggregates network ownership by process connection counts and established connection counts.

Performance note: the live UI loads expensive Windows inventories lazily. Pages such as Tasks, Firewall, Users, Drivers and Eventlog may take a moment to populate the first time you open them, but CPU/RAM/process rendering keeps updating while that happens. --once and --json still collect a full diagnostic snapshot synchronously.

Test Snapshot

dotnet run --project .\winbtop\winbtop.csproj -- --once
dotnet run --project .\winbtop\winbtop.csproj -- --json