use process monitor to find file create process

You can point to the public Microsoft Symbol Server at and Process Monitor / Process Explorer will download the necessary symbol files and show you a better call stack with all the function names instead of the address offsets.īut to enable Process Monitor / Process Explorer to talk to the Microsoft Symbol Server you need to install WinDbg (Microsoft Debugging Tools For Windows) on the machine. Not a lot of people realize that in both Process Monitor and Process Explorer you can configure a symbol server. The call stack in the above image is not very helpful as it is only showing the offset addresses(under Location). Process Monitor also shows you the call stack of the thread that lead to the file system / registry access.

It logs all access to the file system / registry by all processes on the machine (can be filtered). Process Monitor is my favourate and it can be used to monitor file system / registry activity on a machine. Process Explorer can be used to investigate a running process from handles to dlls loaded. Process Monitor and Process Explorer are great tools for troubleshooting issues on Windows machines.

Use process monitor to find file create process