How to use Microsoft's Process Monitor know what a program is doing

[I.____.....__...__]

- 13:10 You can drastically reduce the processing time by dropping filtered events from _Filter → Drop Filtered Events._ You won't be able to un-filter stuff, but the massive performance boost is worth in most cases.
- 14:40 _CreateFile_ is also the Windows API function to open a file. It's confusing but it's too late to change. 🤷 Backwards-compatibility is digital handcuffs, hence why it's important to try to pre-design stuff since you can't change it later.
- 16:40 Windows always creates a link in Recent to everything that you run (through the shell), that's normal and not what Joe is looking for.
- 17:33 That's not a folder, it's a shortcut to a folder. There are only two folders in Recent. That shortcut just means that you opened that Autohotkey folder recently (through some means other than navigating to it through File Explorer). Deleting it just removes it from the jump-list. It's the same as dragging the taskbar button of File Explorer up to see the jump-list, then right-clicking the folder and selecting Remove.
- 18:30 You might also want to filter categories; most of the time you only want to log file and registry changes.

[SpaceCadetJesus]

Windows index likes to open and close files for its own internal purposes. It's very likely that this is the offender.

[lexpsd]

Hello Joe! Where could i text HellBent? There are no info on his channel to contact him.