• Using procmon for this is certainly a new twist on this--thanks!.