Process Monitor (https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx) is an advanced monitoring tool that shows the real-time interaction of the processes with the filesystem, registry, and process/thread activity.
When you run this tool (run as Administrator), you will immediately notice that it captures all the system events, as shown in the following screenshot. To stop capturing the events, you can press Ctrl + E, and to clear all the events you can press Ctrl+ X. The following screenshot shows the activities captured by Process Monitor on a clean system:
From the ...
