ANSWER
Process Monitor is a powerful tool from Microsoft's Sysinternals suite that allows you to monitor the file system, Registry, and process/thread activity in real-time.

Download and Run the Process Monitor:

1. Download Process Monitor from the Microsoft Sysinternals website (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon).
2. Extract the downloaded zip file and run Procmon.exe.
3. Set up Filters (Optional):

• When you first start Process Monitor, it begins capturing events immediately. This can result in massive data, so it's often helpful to set up filters to capture only the data you're interested in.
• Go to the 'Filter' menu, select 'Filter...' or press Ctrl + L.
• You can use the filter dialog to specify which processes, events, or details you want to include or exclude from the capture.

4. Begin Capture:

• If Process Monitor is not already capturing data, you can start by pressing Ctrl + E or click the  icon on the toolbar.
• Allow it to run for as long as necessary to capture the events relevant to your investigation.

5. Save the Capture:

• Once you've captured the necessary data, you can stop the capture by pressing Ctrl + E again or click the icon.
• To save the captured data, go to the 'File' menu and select 'Save...' or press Ctrl + S.
• Please choose the location where you want to save the log file, give it a name, and select the format. The 'PML' file format is the native Process Monitor log format, but you can save the filtered data to a CSV or XML file if you prefer.
• Click 'OK' to save your log.

6. Analyze the Capture:

•  After saving the log, you can analyze it by reopening it in Process Monitor or using other tools if you exported it to CSV or XML.
• Within Process Monitor, you can use the tools and filters to navigate the captured data and find the necessary information.