Great. I can give you some tips for this. Note that the hint I gave you TypedPaths was a part of a registry path (actually a registry key name). So you would need to enable Registry events and filter with: Path Contains TypedPaths to see any registry events about the one that you care about from any task (not just explorer.exe although that is the one that you would expect may be making changes to it). We could be more specific about both but you will soon find that besides being easier to make such filters, using such abbreviations are helpful for discovering things which counter your assumptions in the area you are trying to analyze.